Hibot Best Practices for Authenticating Users via WhatsApp

Bot Automation
Apr 7
4 min read

Using Hibot WhatsApp Business API for OTP and user authentication can provide faster delivery, better trust, and higher conversion rates than SMS.

However, authentication through WhatsApp should be implemented carefully to ensure both security and a smooth user experience.

This guide explains the most important best practices for verifying users with WhatsApp OTP messages.

Why WhatsApp Authentication Requires Extra Security

When a person creates a WhatsApp account, WhatsApp verifies ownership of the phone number using an SMS or call verification code.

But after that initial registration, WhatsApp does not continuously re-check ownership of that phone number.

This means:

A phone number can later be recycled by a telecom provider
The previous owner may still have access to the WhatsApp account
The current owner of the phone number may not own the same WhatsApp account

Because of this, your app should never assume that:

Phone Number = Same WhatsApp User Forever

This is especially important for:

Password reset flows
Account recovery
Two-factor authentication
Sensitive account access

Best Practice 1: Verify the WhatsApp Account First

Before using WhatsApp as a permanent authentication channel, Hibot recommends verifying that the user actually controls the WhatsApp account.

A common method is:

Send an initial OTP on WhatsApp
Ask the user to enter the OTP inside your app
Only after successful verification, link that WhatsApp account to the user profile

This process creates a secure connection between:

Your user account
The WhatsApp account that received the OTP

Best Practice 2: Use an Additional Verification Layer

For sensitive actions like account recovery, sending only a WhatsApp OTP may not be enough.

Add an extra challenge such as:

Device confirmation
Existing password
Email verification
Security question
Biometric confirmation

This creates stronger protection if the phone number has changed owners.

Best Practice 3: Save the WhatsApp Identity Hash

When you send the first OTP through Hibot WhatsApp Business API, the system can return an identity hash.

You should:

Store the identity hash after successful verification
Use the same hash in future OTP requests

Why this matters:

If the phone number is later recycled and a new person registers that number on WhatsApp, future authentication messages will fail instead of being sent to the wrong person.

This makes WhatsApp authentication safer than normal SMS OTP.

Protection Against Phishing

WhatsApp automatically improves security for authentication messages:

OTP messages cannot be forwarded
Messages are end-to-end encrypted
Authentication templates are restricted to secure use only

This reduces the chance of phishing or code theft.

Important Note About Unofficial WhatsApp Apps

Authentication through unofficial WhatsApp apps is not guaranteed to be secure.

Only the official WhatsApp and WhatsApp Business apps are supported.

If users use unofficial or modified apps:

OTP delivery may fail
Security cannot be guaranteed
One-tap autofill may not work correctly

Best Practice 4: Always Collect User Opt-In

Before sending WhatsApp OTP messages, you must collect user consent.

A good authentication screen should allow users to choose how they want to receive the code:

Example:

"How would you like to receive your verification code?"

This improves compliance and user trust.

Best Practice 5: Confirm the User’s WhatsApp Number

Many businesses assume that the user’s mobile number is also their WhatsApp number.

This is not always true.

Users may:

Use a second number for WhatsApp
Use multiple SIM cards
Make typing mistakes

Before sending an OTP, ask the user to confirm their WhatsApp number.

Example:

"We will send your verification code to WhatsApp number +91 98765 43210. Is this correct?"

Best Practice 6: Only Show WhatsApp if It Is Installed

Sometimes users select WhatsApp even though they do not have WhatsApp installed.

This can cause failed message delivery and lower conversion rates.

Hibot recommends checking whether WhatsApp is installed before showing it as an authentication option.

Android: Check if WhatsApp Is Installed

First, add this inside your AndroidManifest.xml:

<queries>
    <package android:name="com.whatsapp"/>
    <package android:name="com.whatsapp.w4b"/>
</queries>

Then use this code:

public boolean isWhatsAppInstalled(final Context context) {
    return isWhatsAppInstalled(context, "com.whatsapp") ||
           isWhatsAppInstalled(context, "com.whatsapp.w4b");
}

public boolean isWhatsAppInstalled(final Context context, final String type) {
    Intent intent = new Intent();
    intent.setPackage(type);
    intent.setAction("com.whatsapp.otp.OTP_REQUESTED");

    PackageManager packageManager = context.getPackageManager();
    List<ResolveInfo> receivers = packageManager.queryBroadcastReceivers(intent, 0);

    return !receivers.isEmpty();
}

If WhatsApp is installed, then show the WhatsApp OTP option.

iPhone: Check if WhatsApp Is Installed

Use this Swift code:

let schemeURL = URL(string: "whatsapp://otp")!
let isWhatsAppInstalled = UIApplication.shared.canOpenURL(schemeURL)

If isWhatsAppInstalled is true, then you can safely show WhatsApp as a verification option.

Best Practice 7: Improve Conversion with One-Tap Autofill

If your OTP messages are delivered successfully but users are not completing verification, the problem is usually friction.

Typing OTP manually takes time.

Instead, Hibot recommends using One-Tap Autofill.

Benefits:

Faster verification
Better user experience
Higher conversion rate
Fewer abandoned login attempts

One-Tap Autofill works best on Android apps.

Best Practice 8: Support Both WhatsApp Apps

Some users use:

WhatsApp Messenger
WhatsApp Business App
Both apps together

Your OTP flow should work with all supported combinations.

Always test your authentication flow with:

WhatsApp consumer app
WhatsApp Business app
Both installed together

Best Practice 9: Be Ready to Receive OTP Immediately

With One-Tap Autofill, the OTP may arrive before your code-entry screen is fully loaded.

This can happen if:

The app is slow
The internet connection is weak
The user changes screens quickly

To avoid losing the OTP:

Save the received code temporarily
Auto-fill it when the verification screen becomes visible

This makes the experience much smoother.

Best Practice 10: Each Business Must Use Its Own WABA

Every company must send authentication templates through its own:

WhatsApp Business Account (WABA)
Verified phone number

Do not share the same WABA or phone number between multiple businesses.

Why?

Because shared WABAs:

Violate WhatsApp policy
Create trust issues
Can reduce message quality
Increase the risk of account restrictions

Final Recommendations from Hibot

For the best WhatsApp OTP experience:

Verify the user’s WhatsApp account before using it permanently
Ask users to confirm their WhatsApp number
Use One-Tap Autofill when possible
Save the identity hash after successful verification
Always collect opt-in before sending OTPs
Only show WhatsApp if the app is installed
Add extra security for password resets and account recovery

With these best practices, Hibot WhatsApp Business API can deliver a safer and more reliable authentication flow than traditional SMS OTP.