Send WhatsApp OTPs with one API call

x-api-key: _ars_2k03_a9f1b8c2d3e4f5061728394a5b6c7d8e9f0123456789abcd

{
  "statusCode": 429,
  "message": "ThrottlerException: Too Many Requests"
}

curl -X POST "https://ars-whatsapp-api.onrender.com/send-otp" \
  -H "x-api-key: $WA_GATEWAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "phoneNumber": "+8801712345678",
    "otp": "482910"
  }'

{
  "statusCode": 200,
  "success": true,
  "message": "OTP sent successfully",
  "data": {
    "messageId": "3EB0A1F4C29D7E83B6105F",
    "recipientJid": "8801712345678@s.whatsapp.net"
  }
}

import crypto from "node:crypto";

// Use Redis or your database in production.
const codes = new Map();

const hash = (code) => crypto.createHash("sha256").update(code).digest("hex");

// 1. Generate a code, remember it, and send it.
export async function sendLoginCode(phoneNumber) {
  const otp = crypto.randomInt(100000, 1000000).toString();

  codes.set(phoneNumber, {
    hash: hash(otp),
    expiresAt: Date.now() + 5 * 60 * 1000, // 5 minutes
    attempts: 0,
  });

  const response = await fetch("https://ars-whatsapp-api.onrender.com/send-otp", {
    method: "POST",
    headers: {
      "x-api-key": process.env.WA_GATEWAY_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ phoneNumber, otp }),
  });

  if (!response.ok) {
    const error = await response.json();
    throw new Error(error.message);
  }
}

// 2. Check the code the user typed in.
export function verifyLoginCode(phoneNumber, code) {
  const entry = codes.get(phoneNumber);
  if (!entry || Date.now() > entry.expiresAt) return false;

  entry.attempts += 1;
  if (entry.attempts > 5) {
    codes.delete(phoneNumber); // too many wrong tries
    return false;
  }

  const ok = crypto.timingSafeEqual(
    Buffer.from(hash(code)),
    Buffer.from(entry.hash),
  );
  if (ok) codes.delete(phoneNumber); // a code works only once
  return ok;
}

const response = await fetch("https://ars-whatsapp-api.onrender.com/send-otp", {
  method: "POST",
  headers: {
    "x-api-key": process.env.WA_GATEWAY_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ phoneNumber, otp }),
});

const body = await response.json();
if (response.ok) return body.data.messageId;

// Validation errors return a list of messages, others a single string.
const message = Array.isArray(body.message) ? body.message.join(", ") : body.message;

switch (response.status) {
  case 400:
    // Bad number or not on WhatsApp: ask the user to check their number.
    throw new UserInputError(message);
  case 429:
    // Too many requests: wait a minute before trying again.
    throw new RetryLaterError(message);
  case 401:
  case 503:
    // Wrong key, or your WhatsApp is disconnected: alert your team.
    // Retrying will not help until it is fixed.
    notifyTeam(message);
    throw new Error("Could not send the code. Please try again later.");
  default:
    throw new Error(message);
}

{
  "message": [
    "OTP code is required"
  ],
  "error": "Bad Request",
  "statusCode": 400
}