Skip to main content
Every sign-in code is a real WhatsApp message that Meta charges to your account. A public sign-in page that sends messages to any number is an attractive target, so StoreTalk applies several layers of protection before any code is sent.

​
Protections

​
Limits

When a limit is hit, the customer sees “Too many code requests. Please wait a while and try again.” The Blocked count in Settings shows how often this happens.

​
Your data and your customers’ data

  • Codes are stored only as a one-way fingerprint and deleted once used or expired.
  • Your website receives only what the customer agreed to share.
  • The sign-in ID (sub) is different for every business, so two businesses can’t match up a customer by it.
  • Each customer is added to your Contacts by their WhatsApp number. Signing in never subscribes anyone to marketing or changes an opt-out.

​
FAQ

The code has to come from a number your customers recognise as yours, and Meta bills those messages to the account that sends them. Using the shared StoreTalk number would show StoreTalk instead of your business. Connect your own account in Settings → WhatsApp.
No. Meta charges your WhatsApp account its authentication-message rate for each code. Customers who use Continue as don’t get a code, so those sign-ins are free.
Check that:
  • Settings shows Ready — codes are sent from your WhatsApp number (not Waiting for Meta).
  • Your WhatsApp connection in Settings → WhatsApp is healthy.
  • The customer entered the right country code and the number uses WhatsApp.
  • You haven’t reached your Codes per day limit (see Blocked in usage).
Your own WhatsApp Business account isn’t connected, or your plan isn’t active. Fix that and the website resumes automatically on the next sign-in.
The client ID or the redirect address your website sends doesn’t match Settings. Redirect addresses must match exactly — including https, www, and the path.
Only if you add their country’s calling code (e.g. 44 for the UK) under Countries for that website. International authentication messages cost more, so add only the countries you need.
Click New secret on the website in Settings and update your website. The old secret keeps working for 24 hours.
Yes — add a Browser or mobile app client. See Mobile apps.
A new number is a new sign-in. Ask the customer to sign in with the new number, then link it to their existing account on your side (for example after they confirm their old details).