WhatsApp OTP API for developers 2026 — send and verify a code, with PHP, Laravel, Node.js and Python examples

Before the first line of code: an OTP app and two keys

1. Create an OTP app in the dashboard

   From OTP in the ArabyBot dashboard: the app name, the name shown in the message, then the sender — the ready shared number, or a WhatsApp number connected to your account. You also set the code length, how long it stays valid and how many verify attempts it gets.

2. Take the public key and the secret

   The public key starts with ab_otp_ and travels in the X-Public-Key header on every call. The secret starts with sk_otp_ and is shown once at creation: keep it in your server's environment variables — it is what you sign requests with and how you check our signature on callbacks.

3. Choose what you lock down

   Three optional settings on the app: request signing (any call without a valid X-Signature is refused), allowed domains for browser calls, and your servers' IP addresses. Switch on the first and third if the call goes through your server.

Five endpoints — the whole contract

The phone is in international format, digits only or with a leading +: 966501234567. Every error comes back in one shape: {"success":false,"error_code":"…","message":"…"}, so build your logic on error_code, not on the message text.

The quickest try: curl

# 1) send the code
curl -X POST https://app.arabybot.com/wa_otp_api/send \
  -H "Content-Type: application/json" \
  -H "X-Public-Key: ab_otp_…" \
  -d '{"phone":"966501234567","lang":"ar"}'

{"success":true,"request_id":"3f6c2a9e-41b7-4c0d-9a51-7e2b8d4f1c60",
 "expires_in":300,"expires_at":"2026-10-01 14:05:00"}

# 2) verify what the user typed
curl -X POST https://app.arabybot.com/wa_otp_api/verify \
  -H "Content-Type: application/json" \
  -H "X-Public-Key: ab_otp_…" \
  -d '{"request_id":"3f6c2a9e-41b7-4c0d-9a51-7e2b8d4f1c60","code":"482913"}'

{"success":true,"request_id":"3f6c2a9e-…","phone":"966501234567",
 "verified_at":"2026-10-01 14:01:12"}

PHP — one function for every call

PHP's built-in cURL is enough, no libraries. Keep the request_id in the user's server-side session, not in the page.

<?php
// One helper for every call. Keys come from the environment, never from the page.
function arabybot_otp(string $action, array $body): array
{
    $raw     = json_encode($body);
    $headers = [
        'Content-Type: application/json',
        'X-Public-Key: ' . getenv('ARABYBOT_OTP_PUBLIC_KEY'),
    ];
    if ($secret = getenv('ARABYBOT_OTP_SECRET')) {   // only if request signing is on
        $headers[] = 'X-Signature: sha256=' . hash_hmac('sha256', $raw, $secret);
    }
    $ch = curl_init('https://app.arabybot.com/wa_otp_api/' . $action);
    curl_setopt_array($ch, [
        CURLOPT_POST => true, CURLOPT_POSTFIELDS => $raw, CURLOPT_HTTPHEADER => $headers,
        CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 15,
    ]);
    $res = json_decode((string) curl_exec($ch), true);
    curl_close($ch);

    return is_array($res) ? $res : ['success' => false, 'error_code' => 'network'];
}

session_start();
$sent = arabybot_otp('send', ['phone' => '201001234567', 'lang' => 'ar']);
$_SESSION['otp_request'] = $sent['request_id'] ?? null;

// …later, when the user submits the code
$check = arabybot_otp('verify', ['request_id' => $_SESSION['otp_request'], 'code' => $_POST['code']]);
if (! empty($check['success'])) {
    // the number is verified
}

Laravel — through Http

Laravel's Http client writes the request in a few lines. If you switch request signing on, sign the very bytes you send: build the JSON yourself and send it with withBody, because ->post() re-encodes the array.

use Illuminate\Support\Facades\Http;

// config/services.php → 'arabybot' => ['otp_key' => env('ARABYBOT_OTP_PUBLIC_KEY')]
$otp = Http::withHeaders(['X-Public-Key' => config('services.arabybot.otp_key')])
    ->baseUrl('https://app.arabybot.com/wa_otp_api')
    ->timeout(15);

$sent = $otp->post('/send', ['phone' => $request->phone, 'lang' => 'ar'])->json();
session(['otp_request' => $sent['request_id'] ?? null]);

$check = $otp->post('/verify', [
    'request_id' => session('otp_request'),
    'code'       => $request->code,
])->json();

if ($check['success'] ?? false) {
    // verified
}

// With request signing on, sign the exact bytes you send:
// $raw = json_encode($body);
// Http::withHeaders([... 'X-Signature' => 'sha256='.hash_hmac('sha256', $raw, $secret)])
//     ->withBody($raw, 'application/json')->post('https://app.arabybot.com/wa_otp_api/send');

Node.js — fetch, no libraries

import crypto from 'node:crypto';

// Node 18+ (built-in fetch). Keys from the environment.
async function otp(action, body) {
  const raw = JSON.stringify(body);
  const headers = {
    'Content-Type': 'application/json',
    'X-Public-Key': process.env.ARABYBOT_OTP_PUBLIC_KEY,
  };
  if (process.env.ARABYBOT_OTP_SECRET) {            // only if request signing is on
    headers['X-Signature'] = 'sha256=' + crypto
      .createHmac('sha256', process.env.ARABYBOT_OTP_SECRET).update(raw).digest('hex');
  }
  const res = await fetch(`https://app.arabybot.com/wa_otp_api/${action}`,
    { method: 'POST', headers, body: raw });
  return res.json();
}

const sent  = await otp('send', { phone: '971501234567', lang: 'ar' });
const check = await otp('verify', { request_id: sent.request_id, code: '482913' });
console.log(check.success ? 'verified' : check.error_code);

Python — requests

import hashlib, hmac, json, os
import requests

def otp(action, body):
    raw = json.dumps(body)
    headers = {"Content-Type": "application/json",
               "X-Public-Key": os.environ["ARABYBOT_OTP_PUBLIC_KEY"]}
    secret = os.environ.get("ARABYBOT_OTP_SECRET")
    if secret:  # only if request signing is on
        headers["X-Signature"] = "sha256=" + hmac.new(
            secret.encode(), raw.encode(), hashlib.sha256).hexdigest()
    return requests.post(f"https://app.arabybot.com/wa_otp_api/{action}",
                         data=raw, headers=headers, timeout=15).json()

sent = otp("send", {"phone": "9647701234567", "lang": "ar"})
check = otp("verify", {"request_id": sent["request_id"], "code": "482913"})
print("verified" if check.get("success") else check.get("error_code"))

Errors and limits — and what to do about each

The verification callback to your server

If you set a callback URL on the app, an otp.verified event reaches you the moment a code verifies, signed with your secret. Compute HMAC-SHA256 of the body as received and compare it with the header before you trust it.

// The callback your server receives when a code is verified (if you set a callback URL)
POST https://your-site.example/otp-callback
X-ArabyBot-Event: otp.verified
X-ArabyBot-Signature: sha256=<HMAC-SHA256 of the raw body, keyed with your sk_otp_ secret>

{"event":"otp.verified","app_id":"12","request_id":"3f6c2a9e-…",
 "phone":"966501234567","verified_at":"2026-10-01T14:01:12+00:00"}

What you pay

On your own number the code goes out as an approved authentication template and Meta bills the recipient country's rate: $0.0036 to an Egyptian number and $0.0107 to a Saudi one, measured on 1,147 codes. On the shared number it is a flat price per code from your wallet ($0.0300), with no Meta account. The table for every Arab country is in the verification-code price in every Arab country.

Developer questions