WhatsApp two-step verification PIN: what to do when register asks for it

What the 6-digit two-step verification PIN does on the WhatsApp Cloud API, when the register call needs your existing one, how to change a forgotten PIN, why you should not loop the call (10 tries in 72 hours), and Meta's PIN deprecation for eligible numbers.

November 10, 2026 · 8 min read

If you register a phone number with the WhatsApp Cloud API, Meta's register call asks for a 6-digit pin. What that value must be depends on one thing: whether the number already has two-step verification turned on. If it does, you must send its existing PIN. If it does not, the PIN you send becomes the number's PIN.

This page covers that call, what to do when you don't know the PIN, and a limit that makes retry loops a bad idea. It also covers a change Meta describes: the PIN is being deprecated for eligible numbers, so what you see on your own number may differ from the steps below.

SendFromChat is an independent product and is not affiliated with Meta or WhatsApp. It runs on Meta's official WhatsApp Cloud API. Meta's rules change; where this page relies on Meta it names the page and the date we read it (10 November 2026).

The short version

Your situation What Meta's docs say to do
New number, no two-step verification Send any 6-digit number as pin. It becomes the number's PIN. Write it down.
Number already has two-step verification Send that number's existing 6-digit PIN.
You don't remember the PIN Change it, then register. The API route works without the PIN; the WhatsApp Manager route needs the current PIN (Meta's Business phone numbers page).
Register keeps failing Stop after a few tries. 10 requests in 72 hours triggers error 133016 and a 72-hour block.
No "Two-step verification" tab in WhatsApp Manager Your number may already be covered by Meta's PIN deprecation (see the last section).

What the register call needs

Meta's registration page says you can only register a number through the API, not through WhatsApp Manager or the App Dashboard. The steps before it are: add the number to your WhatsApp account, verify ownership (an OTP), then call the register endpoint.

The call is a POST to PHONE_NUMBER_ID/register. The two required fields are messaging_product (set to "whatsapp") and pin. Meta describes pin like this:

"If your verified business phone number already has two-step verification enabled, set this value to your number's 6-digit two-step verification PIN. If you cannot recall your PIN, you can change it."

"If your verified business phone number does not have two-step verification enabled, set this value to a 6-digit number. This will be the newly verified business phone number's two-step verification PIN."

(Meta for Developers, "Register a business phone number", read 10 November 2026.)

So the PIN is not something you can skip, and it is not always something you choose. A number that someone else set up, or that you set up earlier and forgot, may already have one. If you register it with a made-up PIN, Meta's page does not say what the response will be; we have not tested that against Meta.

Related: if you are still stuck earlier than this, at the verification code, read WhatsApp number won't connect?. A number that is still in use on the WhatsApp or WhatsApp Business app is a separate problem, covered in WhatsApp Business app vs API.

A register script that runs once

This Node 18+ script sends one register call and then stops. It checks the PIN is six digits, prints Meta's error code and message if the call fails, and does not retry. There is a reason for that, in the next section.

// register-once.mjs
// Register a verified business phone number with the Cloud API, once.
// Node 18+. Run: PHONE_NUMBER_ID=... ACCESS_TOKEN=... PIN=123456 node register-once.mjs
const base = process.env.GRAPH_BASE ?? "https://graph.facebook.com/v27.0";
const { PHONE_NUMBER_ID, ACCESS_TOKEN, PIN } = process.env;

if (!PHONE_NUMBER_ID || !ACCESS_TOKEN || !/^\d{6}$/.test(PIN ?? "")) {
  console.error("Set PHONE_NUMBER_ID, ACCESS_TOKEN and a 6-digit PIN.");
  process.exit(1);
}

let res;
try {
  res = await fetch(`${base}/${PHONE_NUMBER_ID}/register`, {
    method: "POST",
    headers: { Authorization: `Bearer ${ACCESS_TOKEN}`, "Content-Type": "application/json" },
    body: JSON.stringify({ messaging_product: "whatsapp", pin: PIN }),
  });
} catch (e) {
  console.error("Request failed:", e.message);
  process.exit(2);
}
const body = await res.json().catch(() => ({}));

if (res.ok && body.success) {
  console.log("Registered.");
} else {
  const err = body.error ?? {};
  console.error(`Not registered (HTTP ${res.status}, code ${err.code ?? "none"}): ${err.message ?? "no message"}`);
  if (err.code === 133016) console.error("Meta's registration limit is reached. Stop and wait 72 hours.");
  else console.error("Do not loop. Check the PIN and the number's status, then run this once more by hand.");
  process.exit(2);
}

What we ran, and what we did not. We ran this script against a local mock server that we wrote ourselves (it is not Meta). The mock returned success, a 133016 error and a generic error. All three paths printed as expected, an unreachable server printed "Request failed" and exited with code 2, and a PIN that is not six digits or a missing variable exits before any request is sent. We did not run it against Meta, because that needs a verified number and a token. Treat it as a starting point and check Meta's response on your own number.

Don't put the register call in a retry loop

Meta's registration page states the limit this way: "Requests to the registration endpoint are limited to 10 requests per business number in a 72-hour moving window." After 10 requests, "the API returns error code 133016, and the API prevents the number from being registered for the next 72 hours." (read 10 November 2026).

A script that retries on every error can use up the 10 requests quickly, and then the number can't be registered for three days even if you find the right PIN. Fix the cause first (the PIN, or the number's state), then try by hand.

The same page gives the same 10-in-72-hours limit for the deregister endpoint.

You don't know the PIN: change it

Meta's "Business phone numbers" page gives two routes (read 10 November 2026):

  1. WhatsApp Manager. Go to Account tools > Phone numbers, select the number, open the Two-step verification tab and click Change PIN. Meta says you need your current PIN for this route.
  2. The API. Meta says: "If you don't have your PIN, you can change your PIN using the API." You send a POST to the phone number ID with the new pin:
curl -X POST "https://graph.facebook.com/v27.0/PHONE_NUMBER_ID" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"pin": "NEW_6_DIGIT_PIN"}'
# Meta's documented success response: {"success": true}

We have not run this call against Meta. The token needs the whatsapp_business_management permission; Meta's two-step verification page gives that requirement for Solution Partners, so check what your own token can do.

Meta's two-step verification page also has a separate "Reset your PIN" section for the case where you forget or misplace the PIN, with a longer click path through Meta Business settings to the same Change PIN button.

Once you have a PIN you know, store it in your password manager or secrets store next to the access token. Meta's page says your PIN is also needed "when changing your PIN or deleting your phone number from the platform."

Turning two-step verification off

Meta's page says: "Note that you cannot disable two-step verification using the API." In WhatsApp Manager, follow the steps for changing your PIN but click Turn off two-step verification as the last step. Meta says an email with a link goes to the address associated with your business portfolio, and you use that link to disable it. Once disabled, you can turn it back on by setting a new PIN.

Note that this route starts from the same Two-step verification tab, which may not exist for your number (next section).

Meta is deprecating the PIN for eligible numbers

Two Meta pages, read on 10 November 2026, say the 6-digit PIN is being deprecated for eligible Cloud API phone numbers, with eligibility rolling out gradually:

  • On the two-step verification page: "Once a phone number is eligible, the Two-step verification tab no longer appears in WhatsApp Manager and there is no PIN to change there. If the tab is still present, the phone number is not yet eligible."
  • On the "Account model evolution" page, for registration: Meta "no longer uses the supplied PIN to validate registration, clears any residual PIN state, and does not create a new PIN." It also says to keep sending a valid 6-digit pin in register calls "until a separate API contract change is announced."

In practice, as we read it:

  • If the tab is gone, your number may already be eligible and there may be no PIN to find. Keep sending a valid 6-digit value in pin.
  • If the tab is there, treat the number as not yet eligible and use the steps on this page.
  • We can't tell you from the outside whether a given number is eligible. Meta's pages describe a staged rollout, not a list.

What we have not checked

  • How any particular provider or previous host treats a number's PIN when you leave it. Ask whoever hosted the number whether a PIN is set; this page does not name or judge any provider.
  • Whether Meta returns 133005 (Meta's error table: "Two-step verification PIN incorrect") for a wrong PIN on your number. We have not tested it.
  • Meta's behaviour on your own number. Everything above is from Meta's documentation, not from a live number we control.

Where SendFromChat fits

Connecting through SendFromChat uses the Facebook sign-in flow rather than a script like the one above, and the connect step tries the register call for you with a PIN we generate. We have not tested numbers that already have a PIN set by someone else, so if a number won't send after connecting, check the PIN situation above. If a number is stuck before it connects, the troubleshooting list linked above is the place to start. When you're ready, connect your number: the 30-day free trial needs no card. If you prefer to run Meta's API yourself, the Cloud API setup guide covers Meta's side.

Sources

All read 10 November 2026 as Markdown extracts of Meta's pages, not in a browser; none shows a "last updated" date.

SendFromChat stores data in Mumbai, India; transfers from the EU and UK are covered by the Standard Contractual Clauses and the UK Addendum in our Data Processing Agreement.

Do this from your AI assistant

SendFromChat connects Claude, ChatGPT, Cursor or any MCP client to the WhatsApp Business API — templates, bulk sends, inbox, chatbots and sequences, just by asking. 30 days free, no card.

Start free

More guides