Ban risk for OTP/transactional messages any safe-sending guidelines?

[TheNavirides]

Hey team, great project one Docker command and I had the dashboard running in minutes 🙌

I'm planning to use OpenWA to send OTPs and transactional alerts (order updates, login codes, etc.) from my web app/mobile app to existing users. Before I go further, I wanted to ask about WhatsApp account ban risk:

• Since this connects through WhatsApp Web/multi-device rather than the official Business API, what's the realistic ban/restriction risk for a low-volume, transactional-only use case (OTPs to existing users, not cold outreach)?
• Does OpenWA have any built-in "warm-up" period or recommended ramp-up schedule for a fresh number?
• Are there recommended safe limits (messages/hour, messages/day) to stay under WhatsApp's spam detection radar?
• Has anyone here been running OTP/alert workloads in production long-term — and if so, roughly what volume, and any bans experienced?
• Would using a WhatsApp Business number (vs a regular number) meaningfully lower the risk?

I know this isn't the official WhatsApp Business API, so I'm not expecting zero risk, just trying to understand what "safe" usage looks like in practice, and whether pairing it with an SMS/email fallback is the recommended approach for anything auth-critical.

Thanks for the awesome tool either way!

[rmyndharis]

Hi @TheNavirides — thanks for the kind words, and these are exactly the right questions to ask before going to production with OTP/transactional traffic. Rather than rehash the answer here, I've consolidated everything (ban-risk profile, the per-engine trade-off, six practical safe-sending guardrails, the cold-contact silent-drop caveat, and a compliance pointer to the official Cloud API) into a dedicated README section: ⚠️ Before you connect a number — please read.

A few specifics for your OTP use case:

• Realistic ban risk for low-volume OTP to existing users: meaningfully lower than for cold-outreach, because the recipients already expect to hear from you and the volumes are small. Not zero — unofficial automation is always detectable — but low if you observe the guardrails.
• Warm-up: yes, warm up a fresh number for several days (behave like a normal user, exchange a handful of messages with saved contacts, join a group) before routing production OTP through it.
• Rate limits: stay well under WhatsApp's spam-detection thresholds. A few OTP per minute is fine; bursts are not. OpenWA ships a configurable rate limiter (RATE_LIMIT_* env vars) — use it.
• WhatsApp Business vs regular number: a Business number gives you the official profile/branding surface and is what WhatsApp expects for commercial traffic, but it does not make unofficial automation safe. The detection is on the connection pattern, not the account type.
• Fallback: for anything auth-critical, keep an SMS/email fallback. OTP-over-WhatsApp is great as a primary channel for opted-in users; treat it as optimisation, not the only path.

The README section has the full picture. Marking this as answered — happy to dig deeper on any specific point. 🙂