Back to our work

Case study: NextOTP

Building a WhatsApp OTP API for two-factor auth

How we designed and built NextOTP, a developer API that delivers two-factor authentication codes over WhatsApp instead of SMS.

Published , updated

NextOTP was a two-factor authentication service that sent one-time codes over WhatsApp instead of SMS, aimed at developers who needed affordable verification in countries where SMS delivery is expensive or unreliable. This case study covers the problem, the architecture and the main engineering decisions.

Project Background

The client came to us with a clear problem: existing 2FA providers were expensive and had uneven coverage outside a few markets. Small and medium businesses needed an affordable, reliable way to add secure authentication that works in many countries.

We chose WhatsApp as the delivery channel because of:

  • Its reach in markets where SMS is costly
  • High open rates for transactional messages
  • Lower cost per message than international SMS
  • Wide adoption in emerging markets

Technical Architecture

We designed the system around five parts:

  1. API Gateway: Next.js API routes that accept and validate authentication requests
  2. Message Queue: Firebase Cloud Functions for processing and rate limiting
  3. WhatsApp Integration Layer: middleware that talks to the WhatsApp Business API
  4. Analytics: delivery tracking and usage reporting
  5. Developer Dashboard: a React interface for API keys and usage statistics

The split let each part scale on its own during traffic peaks.

Key Challenges and Solutions

Challenge 1: Message delivery reliability

WhatsApp enforces strict rate limits and a template approval process. We added retries with exponential backoff and a fallback to other channels when a message could not be delivered.

Challenge 2: Developer experience

An authentication API has to be easy to adopt. We wrote documentation with working examples and provided a sandbox for testing integrations before going live.

Challenge 3: Cost

To keep the service affordable we cached where it was safe, batched work where possible and sized cloud resources to real demand.

Implementation and Timeline

The project ran for 14 weeks:

  • Weeks 1 to 2: requirements and architecture
  • Weeks 3 to 6: core API and WhatsApp integration
  • Weeks 7 to 9: developer dashboard and documentation
  • Weeks 10 to 12: testing and optimization
  • Weeks 13 to 14: beta launch with the first customers

We worked in two-week sprints with a stakeholder review at the end of each one.

NextOTP has transformed our authentication strategy. We've expanded to new markets where SMS was cost-prohibitive, and our users appreciate the familiar WhatsApp experience.
CTO, SaaS platform

Client name withheld at their request.

Conclusion

NextOTP shows how changing the delivery channel can make an established product category cheaper to run. WhatsApp delivery combined with a developer-friendly API gave the client a verification product aimed at markets that SMS providers serve poorly.