WhatsApp API ile OTP Gönderme - Tam Kılavuz 2026

const res = await fetch("https://api.nabdaotp.com/api/v1/auth/select-instance", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ instanceId: "your-instance-id" })
});

const { accessToken } = await res.json();
// Store securely on your backend — never expose to the client

function generateOTP(length = 6) {
  return Math.floor(
    Math.pow(10, length - 1) +
    Math.random() * (Math.pow(10, length) - Math.pow(10, length - 1))
  ).toString();
}

// Store hash (never store plain OTP)
const crypto = require('crypto');
const otp = generateOTP();
const hash = crypto.createHash('sha256').update(otp + secret).digest('hex');

const payload = {
  phone: "+9647701234567",    // Iraq  (+964)
  // phone: "+9639XXXXXXXX", // Syria (+963)
  message: `Your Nabda verification code is ${otp}. Valid for 5 minutes. Do not share it.`
};

const response = await fetch("https://api.nabdaotp.com/api/v1/messages/send", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": `Bearer ${instanceToken}`
  },
  body: JSON.stringify(payload)
});

const result = await response.json();
if (result.success) {
  console.log("✓ OTP sent via WhatsApp");
}

// On form submission — verify on the BACKEND, never the client
function verifyOTP(userInput, storedHash, secret) {
  const inputHash = crypto
    .createHash('sha256')
    .update(userInput + secret)
    .digest('hex');
  return inputHash === storedHash;
}

await fetch("https://api.nabdaotp.com/api/v1/instances/webhook", {
  method: "PATCH",
  headers: {
    "Content-Type": "application/json",
    "Authorization": `Bearer ${instanceToken}`
  },
  body: JSON.stringify({
    webhookUrl: "https://yourdomain.com/webhook/nabda",
    webhookEnabled: true
  })
});

// Your webhook handler receives events like:
// { event: "message.sent", phone: "+964...", status: "delivered" }