Send OTP codes over WhatsApp with one API call

curl --request POST \
  --url https://waapi.app/api/v1/instances/123/client/action/send-message \
  --header 'authorization: Bearer your-api-token' \
  --header 'content-type: application/json' \
  --data '{
    "chatId": "[email protected]",
    "message": "Your verification code is 482193. It expires in 5 minutes."
}'

<?php

$instanceId = 123;
$apiToken = 'your-api-token';

$ch = curl_init("https://waapi.app/api/v1/instances/{$instanceId}/client/action/send-message");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'authorization: Bearer ' . $apiToken,
        'content-type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'chatId' => '[email protected]',
        'message' => 'Your verification code is 482193. It expires in 5 minutes.',
    ]),
]);

echo curl_exec($ch);

import requests

instance_id = 123
api_token = "your-api-token"

response = requests.post(
    f"https://waapi.app/api/v1/instances/{instance_id}/client/action/send-message",
    headers={"authorization": f"Bearer {api_token}"},
    json={
        "chatId": "[email protected]",
        "message": "Your verification code is 482193. It expires in 5 minutes.",
    },
)

print(response.json())

const instanceId = 123;
const apiToken = 'your-api-token';

fetch(`https://waapi.app/api/v1/instances/${instanceId}/client/action/send-message`, {
  method: 'POST',
  headers: {
    authorization: `Bearer ${apiToken}`,
    'content-type': 'application/json',
  },
  body: JSON.stringify({
    "chatId": "[email protected]",
    "message": "Your verification code is 482193. It expires in 5 minutes.",
  }),
})
  .then((res) => res.json())
  .then(console.log);

<?php
// Your webhook URL. Verify the signature first (see the webhook tutorial).
$event = json_decode(file_get_contents('php://input'), true);

if (($event['event'] ?? '') === 'message') {
    $message = $event['data']['message']['_data'];
    $from = $message['from'];            // chat id of the sender
    $key = trim($message['body'] ?? ''); // e.g. "LOGIN-4821" from your login page

    if ($login = findPendingLogin($key)) {   // your storage
        confirmLogin($login, $from);
        sendMessage($from, 'You are signed in. Not you? Reply STOP.');
    }
}

<?php
// app/Listeners/ConfirmLoginByMessage.php — the Laravel package receives the webhook
// and dispatches MessageEvent for every incoming message.

namespace App\Listeners;

use App\Models\PendingLogin;
use WaAPI\WaAPI\Events\MessageEvent;
use WaAPI\WaAPI\WaAPI;

class ConfirmLoginByMessage
{
    public function handle(MessageEvent $event): void
    {
        if ($event->isFromMe()) {
            return;
        }

        $key = trim($event->getMessage() ?? ''); // e.g. "LOGIN-4821"
        $login = PendingLogin::where('key', $key)->first();

        if ($login) {
            $login->confirm($event->getFrom());
            app(WaAPI::class)->sendMessage($event->getFrom(), 'You are signed in. Not you? Reply STOP.');
        }
    }
}

from flask import Flask, request

app = Flask(__name__)


@app.post("/webhook")
def webhook():
    # Verify the signature first (see the webhook tutorial).
    event = request.get_json()

    if event.get("event") == "message":
        message = event["data"]["message"]["_data"]
        sender = message["from"]               # chat id of the sender
        key = message.get("body", "").strip()  # e.g. "LOGIN-4821" from your login page

        login = find_pending_login(key)        # your storage
        if login:
            confirm_login(login, sender)
            send_message(sender, "You are signed in. Not you? Reply STOP.")

    return "", 204

import express from 'express';

const app = express();
app.use(express.json());

app.post('/webhook', async (req, res) => {
  // Verify the signature first (see the webhook tutorial).
  const event = req.body;

  if (event.event === 'message') {
    const message = event.data.message._data;
    const from = message.from;               // chat id of the sender
    const key = (message.body ?? '').trim(); // e.g. "LOGIN-4821" from your login page

    const login = await findPendingLogin(key); // your storage
    if (login) {
      await confirmLogin(login, from);
      await sendMessage(from, 'You are signed in. Not you? Reply STOP.');
    }
  }

  res.sendStatus(204);
});

app.listen(3000);

# Local test: post a sample incoming message to your own handler.
# Unsigned, so only while the signature check is not in place yet.
curl --request POST \
  --url http://localhost:8000/webhook \
  --header 'content-type: application/json' \
  --data '{
    "event": "message",
    "instanceId": "123",
    "data": {
      "message": {
        "_data": {
          "from": "[email protected]",
          "body": "LOGIN-4821",
          "fromMe": false
        }
      }
    }
  }'