Skip to content
Tawked
Start free
All posts

Sep 9, 2026 · by Tawked

SMS or WhatsApp OTP in Saudi Arabia

Compare SMS and WhatsApp OTP delivery, costs and channel requirements in Saudi Arabia. Learn how to request a retry on another channel with Tawked.

Short version: SMS reaches every handset and costs SAR 0.09 per code sent through Tawked, an OTP verification API for Saudi numbers; WhatsApp costs less per message but needs data and an approved template. Use SMS by default, WhatsApp where the user is already there, and have your system request a new attempt on the other channel when needed.

Two ways to deliver the same six digits

SMS. The code arrives as a text message from a registered sender name. Through Tawked that is Tawked's own sender ID, and the text names your reviewed app. It works on every handset, with or without data, and iOS and Android can read it straight into the input field when the message is formatted for autofill.

WhatsApp. The code arrives as a WhatsApp message from a verified business number, using Meta's authentication template: fixed wording, your code, an optional expiry line, and a copy-code button the user taps once. Through Tawked it comes from Tawked's verified business number, and the template does not name your app. It needs the WhatsApp app and a data connection, and the template has to be approved by Meta before the first send.

Both are one-time codes; neither is "more secure" by itself. What differs is cost, reach and the moment of failure.

Cost per message

Channel Public price for a Saudi number Charged when Notes
SMS through Tawked SAR 0.09 per code sent Sent; a refused or failed send is refunded Tawked's own sender ID; the text names your reviewed app; nothing to register
SMS through a Saudi gateway SAR 0.069 to 0.13 per message, by volume Sent Plus about SAR 230 a year for the sender name; you build the OTP logic
WhatsApp authentication (Meta's rate card) SAR 0.0401 per delivered message for Saudi Arabia, unchanged on Meta's cards since 2025-10-01 and checked on 2026-10-09, as mirrored by two Saudi rate-card guides listed under Sources; verify the current figure on Meta's card Delivered Meta bills only delivered template messages; the provider's own fee comes on top

Checked 2026-09-09; Meta's WhatsApp rate re-checked 2026-10-09. Meta publishes its rate card as downloadable files per currency rather than as a static page, which is why the WhatsApp figure is taken from published mirrors of that card and quoted with a caveat. Tawked's price for a WhatsApp code will be on its pricing page when the channel opens; today Tawked sends codes by SMS.

So on Meta's own rate, a WhatsApp code is cheaper than an SMS code in Saudi Arabia. It is not automatically the better default.

Where each one fails

SMS fails when the number is wrong or ported abroad, the handset is off for hours, or the network filters the message. Delivery is otherwise near-universal, and the user needs nothing installed.

WhatsApp fails when the number has no WhatsApp account, the phone has no data at that moment (a common case for a code typed at a checkout on a laptop while the phone is on a slow connection), the template is not approved, or the user has blocked business messages. When it fails, it often fails silently from the user's point of view: they are waiting for a message that will not come.

Both fail against SIM swap and against a user who reads the code to a caller. Neither channel fixes social engineering; expiry and attempt limits contain the damage.

The practical rule

  1. SMS is the default. Every Saudi number can receive it, no app, no data.
  2. WhatsApp is the second channel, for users who chose it or for a retry when SMS did not arrive. The copy-code button makes it the nicer experience on a phone.
  3. Never make WhatsApp the only path unless you already know the user is on WhatsApp.

One API, the channel is a field

With Tawked the channel is a parameter on the same call, so the fallback is a few lines:

# First attempt: SMS
curl -X POST https://tawked.com/v1/verify/start \
  -H "Authorization: Bearer tk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"to":"0551234567","channel":"sms","lang":"ar"}'

# The user did not get it: start a new verification on the other channel
curl -X POST https://tawked.com/v1/verify/start \
  -H "Authorization: Bearer tk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"to":"0551234567","channel":"whatsapp","lang":"ar"}'

Each start is its own verification with its own id, and checking the code is the same POST /v1/verify/check whichever channel carried it. Per-destination limits apply across both channels, so a user cannot be flooded by retrying, and a send that is refused, or that fails, is not charged. Verification codes over WhatsApp are coming soon (see WhatsApp OTP); SMS works today, with stamped test codes in the sandbox before your app name is approved.

The full reference is at tawked.com/en/docs; what sits behind the two calls is on the Tawked Verify page.

Sources (checked 2026-09-09; Meta's rate re-checked 2026-10-09)

Chat on WhatsApp