Phone-number sign-in is the default in a lot of the world. People don't want another password, many don't use email much, and almost everyone has a phone number they keep for years.
The usual way to prove someone controls a number is an SMS one-time code. It works, but it comes with costs that grow with your user base.
What SMS codes really cost
- Money, on every attempt. Each code is a paid message, whether the sign-in succeeds or the person gives up halfway. Retries and resend buttons cost the same. Prices vary a lot by country, so a product that grows abroad sees its sign-in bill grow faster than its users.
- Registration. Some countries require sender IDs and message templates to be registered before a code can be delivered at all, such as DLT in India.
- Delivery. Codes arrive late, or not at all, on some networks. A sign-in that waits a minute for a text is a sign-in that gets abandoned.
- Typing. The person reads six digits on one screen and types them into another. On a computer, that means picking up the phone anyway.
- Pumping. Anyone can type a number into your sign-in form and make you pay to text it. Abuse of premium-rate numbers ("SMS pumping") turns your login page into someone else's revenue.
None of this is a reason to drop phone sign-in. It's a reason to question who sends the message.
Turn it around
In a WhatsApp sign-in the person sends the code, not you.
- They tap Sign in with WhatsApp.
- WhatsApp opens with a message already filled in:
Sign in to Acme. Send this message as it is.followed by a one-time code. - They tap Send.
- The sign-in service matches the code to the waiting sign-in and records the number the message came from. The app that started the sign-in, which has been polling, finishes it.
The proof is the same as with SMS, possession of the number, but it travels in the other direction. WhatsApp only lets a number send messages after verifying that number itself, so a message from a number is evidence of control, just as receiving a text at it was.
Because the person starts the conversation, there is nothing outbound to pay for per code, and the confirmation ("You're signed in") is a reply in a chat they opened. That is what makes the flow free to run at any volume. It also removes the pumping problem: typing a number into your form sends nothing to it.
What makes it safe
A few details carry the security of this flow.
The code is single-use and short-lived. It's valid for 10 minutes, and the change from waiting to verified is one atomic update, so the same message can't sign in twice. Nobody types the code, so it can be long and random rather than six digits.
The waiting screen holds a secret the chat never sees. The app polls the status with a transaction id that is never part of the message. Seeing the code, for example in a screenshot of the chat, doesn't tell you where to collect the result.
The result is redeemed once, by whoever started it. When the message
arrives, the status hands the waiting app a one-time nonce. From an app with no
backend, that nonce is useless without the PKCE code_verifier the app kept from
the start, the same protection that
makes authorization codes safe in public clients.
With a backend, only your backend's credentials can exchange it.
The message names the app. "Sign in to Acme" is in every code message, and the reply names it again. As with any QR or link-based sign-in, someone could try to get a person to send a code they didn't start. Naming the app in the message is what lets the person notice. If your users are a likely target for that kind of social engineering, pair WhatsApp sign-in with a passkey for sensitive actions.
On a computer
A sign-in started on a laptop shows the WhatsApp link as a QR code. The person scans it with their phone, sends the message from there, and the laptop, which has been polling all along, signs in. It's the same flow, with the phone acting as the second screen.
Where it doesn't fit
- People without WhatsApp. It's ubiquitous in many markets and rare in others. Offer it beside your other sign-in methods, not instead of them.
- Shared phones. The identity is the number. If a family shares one WhatsApp account, they share one user.
- Regulated step-up. If a regulation names a specific factor for a payment or a record change, check that a possession proof over WhatsApp satisfies it.
Trying it with AuthAction
WhatsApp Login is free and unlimited on every AuthAction tenant, with no WhatsApp Business account, number or templates of your own. Create a WhatsApp connection under Connections → Passwordless, enable it for your application, then pick one of three paths:
- the hosted login, which shows a "Sign in with WhatsApp" button beside your other connections;
- an app with no backend, using
@authaction/whatsapp-sdkfor web, React Native and Expo, which returns ordinary AuthAction tokens; - your own backend, which receives the verified phone number and keeps its own session.
The WhatsApp Login docs cover all three, and the connection's Quickstart tab in the dashboard has copy-ready code for React Native, Swift and Kotlin with your tenant filled in.