🚀 Send FREE WhatsApp OTP Messages

https://wa.me/92313XXXXXXX?text=otp

{
  "object": "whatsapp_business_account",
  "entry": [{
    "id": "40752625244XXX",
    "changes": [{
      "value": {
        "messaging_product": "whatsapp",
        "metadata": {
          "display_phone_number": "92313XXXXX",
          "phone_number_id": "43001968685XXX"
        },
        "contacts": [{
          "profile": {
            "name": "Mubashar Shahzad"
          },
          "wa_id": "92300XXXXX"
        }],
        "messages": [{
          "from": "92300XXXX",
          "id": "wamid.HBgMOTIzMDAxNjU0MzIxwA==",
          "timestamp": "1769151710",
          "text": {
            "body": "otp"
          },
          "type": "text"
        }]
      },
      "field": "messages"
    }]
  }]
}

<?php

// ===================================================
// STEP 1: Read incoming WhatsApp webhook data
// ===================================================
$input = file_get_contents("php://input");
$data  = json_decode($input, true);

// Optional: Log all incoming webhooks for debugging
file_put_contents(
    "webhook_log.txt", 
    date('Y-m-d H:i:s') . " " . $input . PHP_EOL, 
    FILE_APPEND
);

// ===================================================
// STEP 2: Extract message from webhook data
// ===================================================
if (isset($data['entry'][0]['changes'][0]['value']['messages'][0])) {
    
    $message = $data['entry'][0]['changes'][0]['value']['messages'][0];
    
    // Only process text messages
    if ($message['type'] === 'text') {
        
        // Get sender's number and message content
        $from = $message['from'];              // e.g., "92300XXXXXXX"
        $text = trim($message['text']['body']); // e.g., "otp"
        
        // ===================================================
        // STEP 3: Check if message is OTP request
        // ===================================================
        if (strtolower($text) === 'otp') {
            
            // Generate random 6-digit OTP code
            $otp_code = rand(100000, 999999);
            
            // ===================================================
            // STEP 4: Store OTP in database (IMPORTANT!)
            // ===================================================
            // Connect to your database
            // $conn = mysqli_connect("localhost", "user", "pass", "db");
            
            // Store OTP with expiry time
            // $expiry = date('Y-m-d H:i:s', strtotime('+5 minutes'));
            // $sql = "INSERT INTO otp_codes (mobile, otp_code, created_at, expires_at) 
            //         VALUES ('$from', '$otp_code', NOW(), '$expiry')";
            // mysqli_query($conn, $sql);
            
            // ===================================================
            // STEP 5: Prepare WhatsApp message payload
            // ===================================================
            $payload = [
                [
                    "mobile" => $from,           // Send to customer's number
                    "type"   => "text",          // Message type
                    "text"   => [
                        "body" => "Your OTP code is: $otp_code\n\nThis code will expire in 5 minutes.\n\nDo not share this code with anyone."
                    ]
                ]
            ];
            
            // ===================================================
            // STEP 6: Send OTP via WhatsApp (FREE!)
            // ===================================================
            $api_url = "https://wa.sendpk.com/api/send.php";
            $api_key = "YOUR_API_KEY_HERE";  // Get from wa.sendpk.com
            
            // Construct final API URL
            $url = $api_url . "?api_key=" . $api_key . 
                   "&free_form=" . urlencode(json_encode($payload));
            
            // Send the request
            $response = file_get_contents($url);
            
            // Optional: Log the response
            file_put_contents(
                "otp_sent_log.txt", 
                date('Y-m-d H:i:s') . " Sent OTP $otp_code to $from - Response: $response" . PHP_EOL, 
                FILE_APPEND
            );
        }
    }
}

// ===================================================
// STEP 7: Always respond with 200 OK
// ===================================================
http_response_code(200);
echo "OK";

?>

CREATE TABLE otp_codes (
    id INT AUTO_INCREMENT PRIMARY KEY,
    mobile VARCHAR(20) NOT NULL,
    otp_code VARCHAR(6) NOT NULL,
    created_at DATETIME NOT NULL,
    expires_at DATETIME NOT NULL,
    verified TINYINT(1) DEFAULT 0,
    INDEX idx_mobile (mobile),
    INDEX idx_otp (otp_code)
);

<?php

// Database connection
$conn = mysqli_connect("localhost", "username", "password", "database");

// Store OTP
$mobile = $from; // From webhook
$otp_code = rand(100000, 999999);
$expires_at = date('Y-m-d H:i:s', strtotime('+5 minutes'));

$sql = "INSERT INTO otp_codes (mobile, otp_code, created_at, expires_at) 
        VALUES (?, ?, NOW(), ?)";

$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "sss", $mobile, $otp_code, $expires_at);
mysqli_stmt_execute($stmt);

?>

<?php

// verify_otp.php
$conn = mysqli_connect("localhost", "username", "password", "database");

// Get submitted data
$mobile = $_POST['mobile'];        // e.g., "92300XXXXXXX"
$submitted_otp = $_POST['otp'];    // e.g., "123456"

// Query database for valid OTP
$sql = "SELECT * FROM otp_codes 
        WHERE mobile = ? 
        AND otp_code = ? 
        AND verified = 0 
        AND expires_at > NOW() 
        ORDER BY created_at DESC 
        LIMIT 1";

$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "ss", $mobile, $submitted_otp);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

if (mysqli_num_rows($result) > 0) {
    // OTP is valid!
    
    // Mark as verified
    $sql_update = "UPDATE otp_codes SET verified = 1 WHERE mobile = ? AND otp_code = ?";
    $stmt_update = mysqli_prepare($conn, $sql_update);
    mysqli_stmt_bind_param($stmt_update, "ss", $mobile, $submitted_otp);
    mysqli_stmt_execute($stmt_update);
    
    echo json_encode([
        "success" => true,
        "message" => "Mobile number verified successfully!"
    ]);
    
} else {
    // Invalid or expired OTP
    echo json_encode([
        "success" => false,
        "message" => "Invalid or expired OTP code"
    ]);
}

?>