WhatsApp Login
WhatsApp Login signs people in with the phone number they already use on WhatsApp. Instead of receiving a code by SMS, the person sends a short message from their own WhatsApp, and WhatsApp itself vouches for the number it came from.
It is free and unlimited on every AuthAction tenant. There are no SMS fees, no per-message or per-verification charges, no WhatsApp Business account to set up and no monthly active user tiers.
Why it costs nothing
Section titled “Why it costs nothing”SMS one-time codes are paid for per message, and in some countries they also need sender registration (DLT in India, for example). WhatsApp Login turns the flow around:
- The person sends the message, so nothing is sent to them to pay for.
- AuthAction’s reply (“You’re signed in”) goes out inside the conversation the person just opened.
- Every tenant shares AuthAction’s WhatsApp Business number, so you never register a number, a template or a sender ID.
How it works
Section titled “How it works”- The person taps Sign in with WhatsApp.
- WhatsApp opens with a message filled in:
Sign in to <your app>. Send this message as it is.followed by a one-time code. - They tap Send. AuthAction matches the code, records the number it came from and replies “You’re signed in”.
- The screen that started the sign-in, which has been waiting, finishes it.
On a computer, or when the person’s WhatsApp is on another phone, show the link as a QR code. They scan it with the phone that has WhatsApp, send from there, and the screen that started the sign-in still signs in.
The code lasts 10 minutes and works once. Nobody types it, so there is nothing to mistype.
Choose how to add it
Section titled “Choose how to add it”| Path | For | You get |
|---|---|---|
| Hosted login | Any app already using AuthAction’s login page | A “Sign in with WhatsApp” button beside your other connections, and the usual tokens |
| App with no backend (SDK) | Mobile apps, React Native / Expo, single-page apps | AuthAction tokens, with no browser, no redirect and no client secret (PKCE) |
| With your backend | Apps that keep their own session | Your backend starts the sign-in and receives the verified phone number |
All three can run side by side in the same application.
Set it up in the dashboard
Section titled “Set it up in the dashboard”- Go to Connections → Passwordless → Create and choose WhatsApp.
- Enable it for your application on the connection’s Applications tab (or the application’s Connections tab). The application’s name is what people see in the message.
- Optionally, set the application’s Refresh token lifetime (up to a year). Each refresh grants it again, so people who keep using the app stay signed in.
That’s all for the hosted login: the button appears on the login page of every application with the connection enabled. The connection’s Quickstart tab has copy-ready code for the other two paths, with your tenant’s domain filled in.
- A person’s identity is their phone number in E.164 format, such as
+919812345678. The same number is the same user every time, in every application of the tenant, whichever path they signed in through. - The number is stored as the user’s
externalIdandusername, and their WhatsApp profile name becomes their name. The connection’s Users tab lists them by phone number. - Blocked users are refused on every path. Turning off Self-service signup in the connection’s settings stops new accounts from being created on the hosted login.
Good to know
Section titled “Good to know”- Sign-ins are stored only in your tenant’s region and deleted after a day.
- The status a waiting screen polls needs no token: the 32-character transaction id is the key, and it never appears in the chat.
- Messages that don’t contain a live code get no sign-in, and a code that has run out gets an “expired or not valid” reply.