Create a one-time code template

An Authentication template is the one that sends a login or verification code. It is a different form from every other template: WhatsApp writes the message itself, so you do not write a body at all. You set the code button and a couple of options around it. Ten minutes, plus Meta’s review.

Before you start — you need a WhatsApp Business number connected on the Integrations page, Message Templates access on that account (or workspace ownership), and, for an autofill button, your Android app’s package name and signature hash.

Steps

Open the editor and set the category

In the sidebar, under Messaging, click Templates, then New Template.

Fill in Name — it is forced to lowercase with underscores, so Login Code becomes login_code — and pick a Language.

Now set Category to Authentication. The form changes underneath you: Header, Body, Footer and Buttons all disappear, replaced by two sections. Name, Category and Language stay where they were.

Choosing Authentication replaces the whole message form. There is no body field to write.

Set the one-time code options

The One-time code section opens with a note explaining who writes what:

WhatsApp generates the message body (“123456 is your verification code.”). You set the security line, expiry, and the code button below.

Two options:

Add a “don’t share this code” security line — a switch that adds a line telling the recipient not to share the code with anyone.
Code expires after (minutes) — optional — a whole number of minutes between 1 and 90, with the placeholder e.g. 10. It is optional; leave it empty if you do not want to set one.

Set up the code button

The Code button section decides how the recipient gets the code out of WhatsApp and into your app or website.

Button type has three options:

Option	What the recipient does
Copy code	Taps the button to copy the code, then pastes it
One-tap autofill	Taps once and your Android app receives the code
Zero-tap autofill	Your Android app receives the code with no tap at all

Copy code needs nothing else. Either autofill option needs your app’s details, so pick Copy code unless whoever built your Android app has given you the two values below.

Button label is up to 25 characters. Its placeholder follows the type you chose — Copy code or Autofill.

For either autofill option, a bordered block appears with the line Autofill needs your Android app details so WhatsApp can hand the code to it. and three fields:

Field	Example
Android package name	`com.example.app`
App signature hash	`K8a/rNrs…`
Autofill label — optional	`Autofill`

The app fields appear only for an autofill button type — a Copy code button needs none of them.

Get the package name and signature hash from whoever built your app. They are what lets WhatsApp hand the code straight to it. The examples above are examples, not formats to copy.

Submit it

Press Submit for review. The toast reads Template submitted for review. and the template joins the list with an amber Pending review pill, which flips to Approved or Rejected on its own when Meta answers.

What does not apply to an authentication template

Because WhatsApp writes the message, none of the ordinary template rules matter here. There is no body to count characters in, no example values to fill, no header file to upload and no extra buttons to add. The only things checked before you submit are the name and the code button.

If something goes wrong

What you see	Why	What to do
`One-tap / zero-tap OTP needs the app package name and signature hash.`	The button type needs Android details and one of the two fields is empty	Fill both, or set Button type to Copy code
`Give the template a name.`	Name is still empty	Fill it in and press again
The body, header and button sections have vanished	Category is Authentication, which replaces them	If you wanted an ordinary message, set the category back
The expiry will not take the number you typed	It is clamped to a whole number of minutes between 1 and 90	Pick a value in that range, or leave it empty
`Meta did not accept this template`	Meta refused it. Its own sentence sits beneath, naming the field and the fix	Fix what it names and submit again