Can WhatsApp one-time passcodes be sent to my Sinch number?

[Sam_Williams]

When onboarding to Sinch's WhatsApp service, you usually have to complete a verification process for the number you'd like to use as a WhatsApp sender ID. This process involves the delivery of a one-time passcode (OTP) to the number you will use as your WhatsApp sender.

To complete this process, you may opt to receive an SMS that contains the OTP.

If you want to associate a Sinch-provided number with your WhatsApp Business profile (and use that Sinch-provided number as your sender ID), you'll need a way to read the content of SMS messages delivered to your Sinch-provided SMS number.

Receiving SMS content sent to your Sinch number

You can receive SMS content sent to your Sinch number using either Conversation API's SMS channel or the standalone SMS API.

Note: In order to send and receive SMS messages, you must have a Sinch number that has SMS functionality. Receiving OTP SMS messages is not currently supported in the United States or Canada.

Receiving SMS content on Conversation API's SMS channel

Note: This method is only supported for customers who have configured the SMS channel on their Conversation API app.

Sinch delivers incoming message payloads via webhook. In order to read the content on incoming messages, you must have a system that can accept and display the payload of that webhook. For example, you may already have your own application set up to accept incoming messages to your Sinch number.

If you don't already have an application set up to accept incoming messages, you may use the Sinch Build Dashboard to review the contents of incoming SMS messages. This can be done using one of the following methods:

• The Conversation API test tool.
  
  
• The Conversation API Queries tool.

Both methods are described in the sub-sections below:

Using the Conversation API test tool

Note: This method is only supported for customers who have configured the SMS channel on their Conversation API app.

To receive incoming messages and review their contents using the Conversation API test tool:

1. Log in to the Sinch Build Dashboard.
   
   
2. Select Conversation API  from the left menu and select the Apps option. The Conversation apps page is displayed:
   
   
   
   
3. Click the name of the app that will receive the SMS message. The app's details page is displayed:
   
   
   
   
4. Navigate to the Test your setup section and click Send test messages.
   
   
   
   
5. The Test messages page is displayed:
   
   
   
6. Click the User-initiated tab:
   
   
7. Click the toggle under Turn on test mode. This will redirect messages and reroute webhooks.
   
   Note: After five minutes of inactivity, test mode will be deactivated.
   
   
   
   

   Warning: Turning on test mode will temporarily reroute your webhooks. While test mode is active, incoming messages will be redirected and won't reach your production system. Additionally, webhook responses may behave differently than in a live environment. This may impact your production traffic and real users. Ensure that your environment is prepared prior to activating test mode.

   
   
   
8. While in test mode, any messages sent to your Sinch number can be viewed in this UI on the Sinch Build Dashboard. Once the OTP message is delivered, you can view the contents of the message by navigating to the Message logs tab and clicking the appropriate entry.
   
   

Note: Without intervention, test mode is set to deactivate after five minutes. You have the option to extend test mode while on the Sinch Build Dashboard. If test mode becomes deactivated prior to the WhatsApp OTP message being sent and received, you will not be able to view the message in the test message UI. Ensure that test mode is active when receiving the WhatsApp OTP message.

Using the Queries tool

Note: This method is only supported if the WhatsApp OTP message has already been successfully sent to your Sinch number and has been processed by Sinch's system. Additionally, this method is only supported for customers who have configured the SMS channel on their Conversation API app.

To review the contents of incoming messages using the Conversation API Queries tool:

1. Log in to the Sinch Build Dashboard.
   
   
2. Click the Queries tab under Conversation API. The Conversation API queries page is displayed:
   
   
   
   
3. Select List Messages from the Query method drop-down list. Then, populate the following fields:
   
   
   • Populate the Key ID and Key secret fields with an access key and a corresponding access key secret.
     
     
   • Select the region associated with your Conversation API app from the Region drop-down list.
     
     
   • Select the Conversation API app that received the SMS message from the App drop-down list.
     
     
   • Select True from the Only recipient originated drop-down list.
     
   
   
   
   
4. Agree to the Terms.
   
   
   
   
5. Click Submit for response
   
   

A list of messages is displayed under Query response. This will include any WhatsApp OTP messages sent to your Sinch number. 

Receiving SMS content using the standalone SMS API

Sinch delivers incoming message payloads via webhook. In order to read the content on incoming messages, you must have a system that can accept and display the payload of that webhook. For example, you may already have your own application set up to accept incoming messages to your Sinch number.

If you don't already have an application set up to accept incoming messages, you may also use a third-party service. For example, you may use Webhook.site to generate a free callback URL, set your SMS webhooks to be delivered to that callback URL, and then view the callback payloads using Webhook.site's user interface.

Note: Webhook.site is a third-party service that Sinch is referencing for example purposes. Third-party software and tools are subject to change at any time. Ensure that you have reviewed your organization's security policies and measures prior to using any third-party tool. Additionally, third-party tools are not controlled by Sinch. The performance of these tools may vary based on your tool selection, configuration, and other variables.

To use Webhook.site to view incoming message payloads:

1. Navigate to Webhook.site.
   
   
2. Copy Your unique URL.
   
   
   
   
3. Navigate to the Sinch Build Dashboard.
   
   
4. Select SMS from the left menu and select the Service APIs option. The Service APIs page is displayed: 
   
   Click the service (either the NAME or the SERVICE PLAN ID) to which the callback URL is to be assigned.
   
   
5. The REST API details page is displayed: 
   
   Navigate to the Assigned Numbers section and ensure that your desired WhatsApp sender number is listed.
   
   
6. Navigate to the Callback URLs section and click Add callback URL.
   
   
7. The Default URL, Outgoing URL, and Incoming URL fields are displayed:
   
   

   
   Paste the unique URL from Webhook.site (copied in step 2 of this process) into the Incoming URL field. Then, click Configure.
   
   

Now, navigate back to Webhook.site. When WhatsApp sends a message to that phone number (or when any MO message is delivered to any number associated with that Service API), an event will be logged on Webhook.site. You can select the event and read the contents of the message to retrieve the OTP.