WhatsApp OTP Service

WhatsApp OTP Service is a self-hosted service for applications that send one-time codes through WhatsApp and verify the codes users submit. Operators use its admin dashboard to pair the WhatsApp account, inspect delivery jobs, and manage message templates. This is the second version of an earlier OTP sender, whatsapp-otp.

The problem

An application needs to generate a code, deliver it through a connected WhatsApp account, and check the user's reply. Requests can arrive faster than messages should be sent. The service records a verification hash and queues the outbound message in SQLite. The dashboard gives operators a view of connection state, job progress, and verification activity.

Key features

• Accept send and verify requests through API routes protected by an x-api-key header.
• Check the international phone number format and query WhatsApp account availability before queuing a send.
• Generate a numeric OTP with Node.js crypto, store its bcrypt hash, and return a send response without the code.
• Compare a submitted code with the latest unverified, unexpired record and mark a match as verified.
• Create, edit, activate, and delete message templates that insert the code through an {otp} placeholder.
• Store delivery jobs with pending, processing, sent, and failed states in SQLite.
• Show WhatsApp pairing QR, job counts, verification statistics, and system resources in the admin dashboard.
• Let operators edit OTP settings and admin credentials through authenticated routes.
• Send optional operational notifications through a Telegram bot.

Technical architecture

Express handles the HTTP API and serves EJS admin pages. The send controller validates the request, applies phone and IP rate limits, generates the code, writes its bcrypt hash to the otp_verifications table, and inserts a delivery job. An integrated worker polls SQLite, claims a pending job, waits a randomized interval, and sends its message through Baileys. A custom SQLite auth adapter persists Baileys credentials and Signal keys. Socket.IO carries WhatsApp status, QR, and resource updates to the Alpine.js dashboard; i18n supplies English and Arabic text.

Engineering highlights

• Verification uses a stored hash and expiry check, while the send endpoint returns status text without the OTP.
• The queue changes a job to processing only while it is still pending, then records the send outcome.
• In-memory limits track requests by phone and IP; the admin login has its own rate limit.
• The admin template switches between left-to-right English and right-to-left Arabic.
• A periodic cleanup removes older verification records according to their status.