Cognito WhatsApp OTP lets an app built on AWS Cognito send its sign-in code over WhatsApp instead of SMS. With Talkalize, a Meta-verified Tech Provider, a code to a Syrian number costs $0.0102–$0.0109 per message, or $12 for a starter bundle of 1,000 OTP messages with no expiry. Your developer adds the WhatsApp step to Cognito's custom sign-in; Talkalize delivers the code.
At a glance
- Price: $0.0109 per OTP at 100 messages, falling to $0.0102 at 50,000+ (Meta fee plus Talkalize fee).
- Starter bundle: 1,000 OTP messages for $12, credit stays in your wallet until used.
- Cognito has no built-in WhatsApp option. Teams add it through Cognito's custom sign-in flow, which your developer controls.
- Channel: the official WhatsApp Business API (Meta Cloud API) through a Meta-verified Tech Provider.
- Template: an approved authentication template with copy-code or one-tap autofill.
- Requirement: a Talkalize account, a WhatsApp Business number and a developer who owns your Cognito user pool.
Cognito WhatsApp OTP: how the pieces fit together
Amazon Cognito handles user accounts, sessions and tokens for your app. It sends SMS codes out of the box, but it has no ready-made WhatsApp channel. The common pattern in public developer guides is to use Cognito's custom authentication challenge: a small piece of your own logic that decides what the user must prove, creates a one-time code, and then checks the answer. AWS also publishes a sample project for WhatsApp codes, but it targets the sign-up message rather than every login, so check it against your case.
That gives you three clear responsibilities:
- Your Cognito setup decides when a code is needed and when the user is signed in.
- Your app's backend creates the code, stores only a protected version of it for a few minutes, and asks Talkalize to send it.
- Talkalize delivers the code in an approved WhatsApp authentication template and reports delivery status.
Nobody on your team has to run WhatsApp infrastructure, and your user table, tokens and permissions stay in Cognito where they already are.
What the user sees
A customer opens your delivery app and types a phone number. A WhatsApp message arrives within seconds from your verified business name, with the code and a button to copy it. On Android, one tap can hand the code to the app. The customer returns to your app, the code is accepted, and Cognito issues the normal session. There is no password to forget and no SMS to wait for.
Your Delivery App verification code is 482913. It expires in 5 minutes. Do not share this code with anyone.
WhatsApp OTP price for Syria (last verified: 30 October 2026)
| Messages | Price per OTP (USD) | Cost of that volume |
|---|---|---|
| 100 | $0.0109 | about $1.09 |
| 1,000 | $0.0106 | about $10.60 |
| 5,000 | $0.0105 | about $52.50 |
| 10,000 | $0.0104 | about $104 |
| 50,000+ | $0.0102 | about $510 per 50,000 |
Pay as you go: no minimum, wallet top-up. The $12 starter bundle for 1,000 OTP messages is on the WhatsApp OTP service page. The platform plans (Free 7-day trial, Starter $49/month, Growth $89/month) cover features such as API calls, and message fees are always paid from the wallet at the rates above. Starter includes 2K API calls per month and Growth 50K, so pick the plan by how many sign-in requests your app makes.
Step by step: adding WhatsApp codes to a Cognito sign-in
- Decide the role of the code. Is WhatsApp the only sign-in step, or the second step after a password? This changes your Cognito design, so settle it first.
- Create your Talkalize account and connect a WhatsApp Business number. Start with the free 7-day trial.
- Get the authentication template approved. Choose copy-code or one-tap autofill and write the short message in Arabic and English.
- Ask your developer to add the custom sign-in steps to your Cognito user pool: one that decides, one that creates and sends the code, one that checks it. Talkalize's team shares the integration details and helps you test.
- Set safety limits: a short expiry (three to five minutes), a limit on wrong attempts, and a limit on how many codes one phone number can request per hour.
- Test with real Syrian numbers on the networks your customers use, then switch on delivery-status tracking so support can see failed sends.
- Top up the wallet or buy the $12 bundle and launch to a small group before opening to everyone.
Passwordless login or a second factor? Choose before you build
Cognito projects go wrong most often because the team built the code step before deciding what it protects.
WhatsApp code as the only step
Best for consumer apps where users forget passwords: ride-hailing, food delivery, wallets for small payments. Fewer screens, fewer support tickets. The phone number becomes the identity, so you need a plan for people who change numbers.
WhatsApp code after a password
Better for accounts that hold money or private records, such as a remittance agent portal or a clinic patient app. Cognito checks the password first, then the code confirms the person holds the phone.
Code only for risky actions
Many teams keep a normal session and ask for a fresh WhatsApp code only when the user changes the phone number, adds a payout account or resets access. This costs the least because fewer codes are sent.
What sign-in codes cost at your volume
Cognito sign-in sends a code at every fresh login, not only at registration, so volume grows with your active users. An app with 10,000 code requests in a month pays about $104 in message fees at $0.0104. If half of your users stay signed in for weeks, the figure is far lower. Cap resend requests, because every resend is a new billable message.
Syria conditions that shape the design
Three local facts matter when you plan sign-in for Syrian users. All three were checked on 30 October 2026.
- SMS is not always reliable. A telecom operator alert from Telesign recorded an SMS delivery degradation on MTN Syria on 20 October 2026, resolved after roughly three and a half hours. Twilio's Syria guidance says delivery to Syriatel is best-effort for senders that cannot register a sender ID. A second channel for the same code is sensible.
- Codes get filtered. In May 2026 the Syrian outlet Enab Baladi quoted a technology expert saying message-filtering and call-blocking apps sometimes push verification codes from short-code senders into spam, and the problem touches both Syriatel and MTN lines. A WhatsApp message arrives in the chat the customer already reads.
- The audience is mobile first. DataReportal's Digital 2026 Syria report, citing GSMA Intelligence, counts about 20.1 million cellular connections at the end of 2025 but only about 9.25 million internet users (35.8%). Many customers sign in from a phone only, so design for a single device and slow data.
Cognito with WhatsApp: your options compared
| Option | Strength | Watch out for |
|---|---|---|
| Cognito's built-in SMS | No extra build work | Delivery problems on some Syrian routes; sender registration limits for foreign senders |
| Talkalize WhatsApp OTP | Official API, Arabic and English, $12 starter bundle, Syria prices | Needs a developer to add the custom steps |
| Authsignal with Cognito | Ready-made integration and pre-built screens (see its documentation) | Pricing and Syria coverage: check the provider's site |
When another option may fit better: if your users are mostly in countries where SMS works well and you have no developer time, Cognito's built-in SMS is simpler. If you want a hosted sign-in screen with little custom work, an identity vendor may suit you more.
Use cases
Delivery and ride apps
A driver-matching app asks for a code only when a rider logs in from a new phone. The code arrives on WhatsApp in seconds, so a customer standing outside is not stuck waiting for an SMS.
Money transfer agent portals
An agent signs in with a password, then confirms with a WhatsApp code before approving a payout. The two steps protect the account, and the log shows which phone confirmed each action.
University and training portals
Students open the results portal at the same hour each semester. WhatsApp codes spread across the day cost the same per message, and the Arabic template reads clearly on any phone.
Clinic patient apps
A clinic asks for a code before showing lab results. Copy-code helps older patients who find typing six digits between apps difficult.
Mistakes teams make with Cognito custom sign-in
- Forgetting to end the flow once the code is correct, so the user loops back to the code screen. Public developer forums describe this exact issue.
- Keeping the code in readable form or leaving it valid for an hour.
- No limit on resend, which creates cost and abuse.
- Using the same template wording for sign-in and for marketing. Keep authentication messages short and plain.
- Skipping a fallback for users whose WhatsApp is on another number. Offer a clear help route.
Start with the $12 bundle
Ready to test Cognito WhatsApp OTP? Open the WhatsApp OTP page, check API pricing or begin the free 7-day trial. Your messages travel over the official WhatsApp Business API. Related reading: WhatsApp OTP service for apps in Syria, SMS alternative for verification in Syria, OTP for Flutter apps and the authentication and OTP guide.
Frequently Asked Questions
How do I send a WhatsApp OTP from Cognito to a Syrian number?
Add a custom sign-in step to your Cognito user pool that creates a code and asks Talkalize to send it in an approved WhatsApp authentication template, then add a step that checks the answer. Talkalize shares the integration details and helps you test.
Does Amazon Cognito support WhatsApp OTP out of the box?
No. Cognito sends SMS codes by default and has no ready-made WhatsApp channel. Teams add WhatsApp through Cognito's custom sign-in flow.
How much does a WhatsApp OTP to Syria cost?
Between $0.0102 and $0.0109 per message depending on volume (last verified 30 October 2026). A starter bundle of 1,000 OTP messages costs $12 with no expiry.
Can WhatsApp be the only sign-in step, or should it follow a password?
Both work. Use WhatsApp alone for consumer apps where users forget passwords, and add it after a password for accounts that hold money or private records.
Do I need an SMS fallback for users without WhatsApp?
Plan a clear help route for users whose WhatsApp is on another number. Many teams keep SMS as a backup channel for those cases.
Which template type do I need for sign-in codes?
An authentication template with copy-code or one-tap autofill. Talkalize helps you submit it for Meta approval in Arabic and English.
Is there a free way to test before paying?
Yes. Start the free 7-day trial, then top up the wallet or buy the $12 starter bundle to test with real Syrian numbers.
