OTP Verification via WhatsApp

OTP Verification via WhatsApp

When you configure WhatsApp OTP verification, respondents who access your form via public links will be required to enter their mobile number that is registered with WhatsApp to receive a One-Time Password and verify it before they can access the form.

Before you configure to send WhatsApp OTP Verification, ensure that you have certain pre-requisites fulfilled:
  1. You must create your Meta and WhatsApp Business accounts.
  2. Create or select your WhatsApp Business profile.
  3. Verify your WhatsApp business number.
  4. Create a new channel in Zoho Forms account Control Panel.
  5. Create a WhatsApp message template and send for WhatsApp approval. We strongly recommend using the AUTHENTICATION message template, which is exclusive for sending OTPs via WhatsApp.
Know more about setting up these pre-requisites.

Setting Up WhatsApp OTP Verification

  1. Open your form to which you want to configure WhatsApp OTP verification.
  2. In the left panel, under Form Fields scroll to Advanced Elements and click Verification Page.
  3. In the Verification Page configuration screen, click Configure on the OTP Verification card.
  4. In the Configure OTP Verification popup, select WhatsApp.

    WhatsApp OTP Verification
  5. Select the Channel ID and Template ID from the respective dropdowns.
Notes
Note:
  1. The template you choose must contain a minimum of one placeholder.
  2. Templates used for OTP verification should not contain dynamic headers.

OTP Expiry Settings

Here you can configure expiration and resend options for the OTP.

OTP Expiry Settings

OTP Expiration Time
This option sets the amount of time (in minutes) that an OTP is valid for, after it is generated. If the OTP is not used within this time frame, it will expire and the respondent will have to request a new one.

Set the Same Expiration Time for OTP Session
This option allows you to synchronize the OTP session duration with the OTP validity period.
  1. When you select this option, the OTP session will expire at the same time as the OTP itself. This means if you set the OTP expiration time to 5 minutes, the session will also expire after 5 minutes. This ensures that both the OTP and the session in which it was generated expire simultaneously.
  2. If this option is left unchecked, the session will follow its default expiration time of 4 hours. In this case, even if the OTP expires (for example, in 5 minutes), the session will remain active for up to 4 hours unless manually terminated or interrupted by other actions. This means you are allowing the user more time within the session, but they will need to request a new OTP after the OTP expires. This can be useful in cases where users need more time in their session, but a short OTP expiration time is still desired. 
Number of OTP Resend Requests Allowed
This option determines how many times a user can request a resend of the OTP. Select a number from the dropdown. This limits the number of times a user can request for a new OTP to avoid excessive requests for OTP generation.

Show OTP Resend Option After
This option lets you specify the waiting period (in seconds) before the user can request an OTP resend. Set the time delay after which the user will see the option to resend the OTP.

Map OTP Verification Field

You can pre-fill a phone field in the form with the verified mobile number by selecting the required form field from the 
dropdown.

Map OTP Verification Field

Info
Make sure to include the Country Code in the Phone field Properties in your form builder.
You can choose to use the prefilled value of the selected field for OTP verification by selecting the checkbox as shown above. The value can be prefilled from integrated sources like CRM/ Dynamic prefill from Webhooks/ Field Alias/ Static Prefill URLs. To do this, select the checkbox to use the pre-filled value of the mapped field for verification. In this case, the OTP will be sent exclusively to the prefilled value and cannot be modified on the Verification Page.

Notes
Note:
  1. The following properties configured for the selected Phone field will be applied to the phone number entered by the respondent for verification:
  1. Field Format
  2. Allowed Country codes
  3. Default Country code
  4. Input Range
  5. Allow only numbers validation
  6. No Duplicates validation
  7. Phone input confirmation
  1. If you want to restrict your respondent from editing the pre-filled Phone field in the live form, select the Disable Field option under Phone field Properties.
  2. If the phone field is pre-filled through an integrated service or Field Alias, it cannot be modified on the Verification page. The OTP will be sent exclusively to this pre-filled value.

Instructions & Consent

You can add instructions and a consent declaration for respondents on the Verification Page.

Instructions & Consent

Instructions: Enter any information or guidance you want respondents to read before verifying. 

Consent: To include a consent declaration, select Yes for Do you want to include consent? and enter the consent text. Respondents will need to acknowledge the consent before they can proceed with verification.

CAPTCHA

CAPTCHA

To add an extra layer of security and prevent spam entries, you can enable a CAPTCHA on the Verification Page to evaluate if it is a human or a bot that is filling your form. Under CAPTCHA, select the CAPTCHA Type from the dropdown. Learn more

Notes
Note:
  1. To ensure that your WhatsApp OTPs are successfully delivered, it is necessary to purchase the IM credits Add-On from the store in addition to your existing Zoho Forms subscription.
  2. If you have changed the ownership of your form, the configuration for WhatsApp OTP Verification may not work as intended. The new owner must reconfigure the OTP Verification via WhatsApp.

Info
Plan wise limit for the maximum number of forms that can have OTP configuration:
Basic - 25
Standard - 100
Professional - 200
Premium - 200
Express - 200
Zoho One Enterprise - 200
Zoho One Enterprise Trial - 3