OTP over SMS or WhatsApp in Sri Lanka

Short answer: neither channel wins every time, so most apps should use both. SMS reaches any phone without a data connection and costs LKR 0.50 per transactional SMS with Bloomwire. WhatsApp authentication templates cost about the same (indicatively ~LKR 0.66) and can autofill on Android, but only reach users who have WhatsApp and a working connection. Send on one channel, fall back to the other, and apply the same expiry and rate limits to both.

Updated 29 October 2026.

How a one-time code flow works

A one-time password (OTP) proves that the user controls a phone number right now. The flow is the same on either channel:

The user enters a phone number, or starts a sensitive action such as a payment or password reset.
Your server generates a random code, stores a hash of it with an expiry time, and links it to that user and that action.
The code is sent by SMS or by a WhatsApp authentication template.
The user types, pastes or autofills the code, and your server checks it once, then deletes it.

The channel only changes step 3. What makes OTP safe happens on your server, so the security rules below apply to both.

SMS: works on any phone, with known limits

SMS works on feature phones, needs no app and no mobile data, and users already expect codes to arrive this way.

Cost: Bloomwire's published price for transactional SMS is LKR 0.50 per SMS, including government taxes, with no setup fee or monthly charge. OTPs through the Bloomwire Verify API are sent as transactional SMS.
Sender ID: unregistered alphanumeric sender IDs are at risk of being blocked on Sri Lanka's largest networks, so register yours before launch. Bloomwire registers the sender ID and submits it for approval as part of account setup.
Length: keep the message short. A standard GSM SMS holds 160 characters; Sinhala or Tamil text uses Unicode, which allows 70 characters per SMS.

The weaknesses are well documented. The OWASP Multifactor Authentication Cheat Sheet lists SIM-swap attacks, phishing, codes visible on a locked screen and the cost of attackers triggering large numbers of messages. NIST SP 800-63B-4 states that "use of the PSTN for out-of-band verification is restricted", which covers SMS and voice codes. In NIST's terms, a restricted authenticator can still be used, but the service must make other authenticator types available to its users.

WhatsApp authentication templates: what Meta allows

If your app sends codes over WhatsApp, Meta requires an authentication template. These templates are tightly controlled:

The body is preset text: "<VERIFICATION_CODE> is your verification code." You can add an optional "do not share" security line and an expiry footer (1 to 90 minutes).
URLs, media and emojis are not supported, and the code itself can be up to 15 characters.
The default time-to-live (TTL) for authentication templates is 10 minutes. If WhatsApp cannot deliver within the TTL, it stops trying, and you can set a different TTL.

Meta offers three button types:

Copy code: the user taps to copy the code and pastes it into your app. Meta recommends this for iOS versions before 26. On iOS 26 and later, copy code templates also show as keyboard suggestions for one-tap entry.
One-tap autofill: on Android, tapping the button opens your app and passes the code in. It needs changes in your Android app.
Zero-tap: Android only. Your app receives the code in the background, so the user never leaves your app.

Meta's indicative rate for authentication messages in Sri Lanka is about US$0.002 (~LKR 0.66) per delivered message, paid directly to Meta. Meta has also listed Sri Lanka for authentication-international rates from 1 October 2026. These rates can apply when an eligible business based in another country sends codes to Sri Lankan numbers, so check Meta's rate card if your company is registered abroad.

SMS and WhatsApp OTP side by side

Factor	SMS OTP	WhatsApp authentication template
Who it reaches	Any mobile phone, no data needed	Users with WhatsApp and a connection
Cost	LKR 0.50 per transactional SMS (Bloomwire)	About US$0.002 (~LKR 0.66), indicative, paid to Meta
Message wording	Your own text from a registered sender ID	Meta's preset text, no URLs, media or emojis
Entry	Type or paste	Copy code, one-tap (Android), zero-tap (Android)
Delivery confirmation	Delivery reports	Status webhooks, including delivered and failed
NIST position	Restricted authenticator	Not PSTN, but still tied to the phone number

Designing the fallback and the timing

Two common patterns:

WhatsApp first, SMS fallback: suits app users on smartphones. Send the template and listen for status webhooks. Meta notes that the send response does not confirm delivery. If you get a "failed" status, or no "delivered" status within a short wait you choose, show a "Send by SMS instead" option.
SMS first, WhatsApp fallback: suits services with many feature-phone users, or users who may have data but weak SMS coverage, such as people travelling abroad.

Timing rules that prevent confusion:

When you switch channel, issue a new code and invalidate the old one, so a late message can't be used.
Set the WhatsApp TTL and the expiry footer no longer than the code's real validity on your server.
Show a countdown before the resend button appears, and cap the number of resends per number and per device.

Security rules for both channels

Length and randomness: NIST requires at least six decimal digits from a secure random source. OWASP suggests eight or more digits where usability allows.
Short expiry: NIST treats the authentication as invalid unless it is completed within 10 minutes. Shorter is fine for payments.
Single use: accept each code once, and invalidate it as soon as it is verified.
Rate limiting: NIST caps consecutive failed attempts at no more than 100 and lets you set lower limits. Also limit how many codes a number, IP address or device can request, because each SMS costs money and attackers abuse this.
No codes in logs: OWASP advises against storing OTP values in long-term plaintext.
Keep codes out of marketing: send OTPs only as transactional SMS or authentication templates. Never add a code to a promotional SMS or marketing template, and never ask users to share a code.
Offer a stronger option for high-value actions: NIST expects alternatives to restricted authenticators, so consider app-based or passkey sign-in alongside OTP.

Where the Bloomwire Verify API fits

The Bloomwire Verify API sends one-time codes by SMS and by WhatsApp authentication templates through a simple REST API. Typical uses are account creation, two-factor login and password reset, financial transactions, other sensitive actions and phone-number login. SMS codes go out as transactional SMS at LKR 0.50 each, with high delivery priority and real-time delivery reports. Still choosing between a gateway, an API and a web portal? Read our comparison of SMS gateways, APIs and portals.

Frequently asked questions

Is WhatsApp OTP cheaper than SMS in Sri Lanka?

No. Bloomwire's transactional SMS is LKR 0.50, against Meta's indicative ~LKR 0.66 (about US$0.002). The difference is small, so choose on reach and user experience.

Can I add my brand or a link to a WhatsApp authentication template?

No. The body is Meta's preset text, and URLs, media and emojis are not supported. Beyond the code and the button, you can only add the optional security line and expiry footer. Put your branding on the sign-up screen instead.

Does NIST ban SMS OTP?

No. NIST SP 800-63B-4 classes PSTN delivery, including SMS, as restricted. You can use it, but you should offer other authenticator types and consider risk signals such as a recent SIM change.

How long should an OTP be valid?

NIST sets 10 minutes as the maximum for out-of-band codes. Many teams use less for payments. Whatever you choose, match the WhatsApp expiry footer and TTL to it.

Do I need a registered sender ID for OTP SMS?

Yes, register one before launch. Unregistered alphanumeric sender IDs risk being blocked on major Sri Lankan networks. Bloomwire registers your sender ID and submits it for approval.

Sources

SMSSMS GatewaySri LankaTransactional SMSWhatsApp APIWhatsApp Business API

Bloomwire team

Notes on messaging, voice and AI from the team building Sri Lanka's communication platform.

More insights

OTP over SMS or WhatsApp in Sri Lanka: which channel for sign-ups and payments?