Skip to content
Tawked
Start free
All posts

Sep 9, 2026 · by Tawked

SMS or WhatsApp for OTP in Saudi Arabia? Cost, delivery, and when to use each

How an SMS code and a WhatsApp authentication template differ for Saudi users, what each costs per delivered message in 2026, where each one fails, and the fallback pattern that uses both from one API call.

Two ways to deliver the same six digits

SMS. The code arrives as a text message under your registered sender name. It works on every handset, with or without data, and iOS and Android can read it straight into the input field when the message is formatted for autofill.

WhatsApp. The code arrives as a WhatsApp message from a verified business number, using Meta's authentication template: fixed wording, your code, an optional expiry line, and a copy-code button the user taps once. It needs the WhatsApp app and a data connection, and the template has to be approved by Meta before the first send.

Both are one-time codes; neither is "more secure" by itself. What differs is cost, reach and the moment of failure.

Cost per delivered message

Channel Public price for a Saudi number Charged when Notes
SMS through Tawked SAR 0.09 per delivered code Delivered Sender name reviewed and included
SMS through a Saudi gateway SAR 0.069 to 0.13 per message, by volume Sent Plus about SAR 230 a year for the sender name; you build the OTP logic
WhatsApp authentication (Meta's rate card) SAR 0.0401 per delivered message for Saudi Arabia on the card effective 2026-07-01, as mirrored by two Saudi rate-card guides listed under Sources; verify the current figure on Meta's card Delivered Meta bills only delivered template messages; the provider's own fee comes on top

Checked 2026-09-09. Meta publishes its rate card as downloadable files per currency rather than as a static page, which is why the WhatsApp figure is taken from published mirrors of that card and quoted with a caveat. Tawked prices WhatsApp verification per account on request.

So on Meta's own rate, a WhatsApp code is cheaper than an SMS code in Saudi Arabia. It is not automatically the better default.

Where each one fails

SMS fails when the number is wrong or ported abroad, the handset is off for hours, or the network filters the message. Delivery is otherwise near-universal, and the user needs nothing installed.

WhatsApp fails when the number has no WhatsApp account, the phone has no data at that moment (a common case for a code typed at a checkout on a laptop while the phone is on a slow connection), the template is not approved, or the user has blocked business messages. When it fails, it often fails silently from the user's point of view: they are waiting for a message that will not come.

Both fail against SIM swap and against a user who reads the code to a caller. Neither channel fixes social engineering; expiry and attempt limits contain the damage.

The practical rule

  1. SMS is the default. Every Saudi number can receive it, no app, no data.
  2. WhatsApp is the second channel, for users who chose it or for a retry when SMS did not arrive. The copy-code button makes it the nicer experience on a phone.
  3. Never make WhatsApp the only path unless you already know the user is on WhatsApp.

One API, the channel is a field

With Tawked the channel is a parameter on the same call, so the fallback is a few lines:

# First attempt: SMS
curl -X POST https://tawked.com/v1/verify/start \
  -H "Authorization: Bearer tk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"to":"0551234567","channel":"sms","lang":"ar"}'

# The user did not get it: start a new verification on the other channel
curl -X POST https://tawked.com/v1/verify/start \
  -H "Authorization: Bearer tk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"to":"0551234567","channel":"whatsapp","lang":"ar"}'

Each start is its own verification with its own id, and checking the code is the same POST /v1/verify/check whichever channel carried it. Per-destination limits apply across both channels, so a user cannot be flooded by retrying, and you are charged only for what was delivered. WhatsApp is enabled per account on request; SMS works from day one, in the sandbox before your sender name is even approved.

The full reference is at tawked.com/en/docs; what sits behind the two calls is on the features page.

Sources (checked 2026-09-09)

Chat on WhatsApp