Send Free WhatsApp OTP Messages

https://wa.me/92313XXXXXXX?text=otp

{
  "object": "whatsapp_business_account",
  "entry": [{
    "id": "40752625244XXX",
    "changes": [{
      "value": {
        "messaging_product": "whatsapp",
        "metadata": {
          "display_phone_number": "92313XXXXX",
          "phone_number_id": "43001968685XXX"
        },
        "contacts": [{
          "profile": { "name": "Mubashar Shahzad" },
          "wa_id": "92300XXXXX"
        }],
        "messages": [{
          "from": "92300XXXX",
          "id": "wamid.HBgMOTIzMDAxNjU0MzIxwA==",
          "timestamp": "1769151710",
          "text": { "body": "otp" },
          "type": "text"
        }]
      },
      "field": "messages"
    }]
  }]
}

<?php

// STEP 1: Read incoming WhatsApp webhook data
$input = file_get_contents("php://input");
$data  = json_decode($input, true);

// STEP 2: Extract message from webhook data
if (isset($data['entry'][0]['changes'][0]['value']['messages'][0])) {

    $message = $data['entry'][0]['changes'][0]['value']['messages'][0];

    if ($message['type'] === 'text') {
        $from = $message['from'];              // e.g. "92300XXXXXXX"
        $text = trim($message['text']['body']); // e.g. "otp"

        // STEP 3: Check if the message is an OTP request
        if (strtolower($text) === 'otp') {

            // STEP 4: Generate a random 6-digit OTP code
            $otp_code = rand(100000, 999999);

            // STEP 5: Store the OTP in your database with an expiry (see Step 5)

            // STEP 6: Send the OTP via WhatsApp (free, Service category)
            $payload = [[
                "mobile" => $from,
                "type"   => "text",
                "text"   => ["body" => "Your OTP code is: $otp_code\n\nThis code will expire in 5 minutes.\n\nDo not share this code with anyone."]
            ]];

            $api_url = "https://wa.sendpk.com/api/send.php";
            $api_key = "YOUR_API_KEY_HERE";
            $url = $api_url."?api_key=".$api_key."&free_form=".urlencode(json_encode($payload));
            $response = file_get_contents($url);
        }
    }
}

// STEP 7: Always respond with 200 OK
http_response_code(200);
echo "OK";

?>

CREATE TABLE otp_codes (
    id INT AUTO_INCREMENT PRIMARY KEY,
    mobile VARCHAR(20) NOT NULL,
    otp_code VARCHAR(6) NOT NULL,
    created_at DATETIME NOT NULL,
    expires_at DATETIME NOT NULL,
    verified TINYINT(1) DEFAULT 0,
    INDEX idx_mobile (mobile),
    INDEX idx_otp (otp_code)
);

<?php

$conn = mysqli_connect("localhost", "username", "password", "database");

$mobile = $_POST['mobile'];        // e.g. "92300XXXXXXX"
$submitted_otp = $_POST['otp'];    // e.g. "123456"

$sql = "SELECT * FROM otp_codes
        WHERE mobile = ? AND otp_code = ? AND verified = 0 AND expires_at > NOW()
        ORDER BY created_at DESC LIMIT 1";

$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "ss", $mobile, $submitted_otp);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

if (mysqli_num_rows($result) > 0) {
    $sql_update = "UPDATE otp_codes SET verified = 1 WHERE mobile = ? AND otp_code = ?";
    $stmt_update = mysqli_prepare($conn, $sql_update);
    mysqli_stmt_bind_param($stmt_update, "ss", $mobile, $submitted_otp);
    mysqli_stmt_execute($stmt_update);
    echo json_encode(["success" => true, "message" => "Mobile number verified successfully!"]);
} else {
    echo json_encode(["success" => false, "message" => "Invalid or expired OTP code"]);
}

?>

<form id="registrationForm">
  <label>Name:</label>
  <input type="text" name="name" required>

  <label>Email:</label>
  <input type="email" name="email" required>

  <label>Mobile (with country code):</label>
  <input type="text" name="mobile" id="mobile" placeholder="92300XXXXXXX" required>

  <button type="button" onclick="requestOTP()">Verify via WhatsApp</button>
</form>

<div id="otpSection" style="display:none">
  <input type="text" id="otpCode" placeholder="Enter 6-digit code" maxlength="6">
  <button onclick="verifyOTP()">Verify OTP</button>
</div>

<script>
function requestOTP() {
  var mobile = document.getElementById('mobile').value;
  if (!mobile) { alert('Please enter your mobile number'); return; }

  window.open('https://wa.me/92313XXXXXXX?text=otp', '_blank');
  document.getElementById('otpSection').style.display = 'block';
}

function verifyOTP() {
  var mobile = document.getElementById('mobile').value;
  var otp = document.getElementById('otpCode').value;

  fetch('verify_otp.php', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: 'mobile=' + mobile + '&otp=' + otp
  })
  .then(response => response.json())
  .then(data => { alert(data.success ? data.message : 'Error: ' + data.message); });
}
</script>