wa2fa — WhatsApp 2FA for Keycloak

wa2fa is a Keycloak 26.x authentication plugin that replaces SMS one-time passcodes with WhatsApp delivery via the Meta Cloud API. It drops into an existing Keycloak realm as a second factor with no custom UI and no per-message SMS carrier bill.

The problem

SMS OTPs are reliable, but at scale the per-message carrier fees become one of the largest recurring line items in an identity budget — and delivery can be slow or unreliable in some regions. Teams wanted the same trusted second-factor experience without that cost or the SMS gateway dependency.

Our approach

We built a Keycloak Authenticator SPI that requests a one-time code, sends it as a templated WhatsApp Business message through the Meta Cloud API, and validates it back into the standard Keycloak login flow — so it behaves like any other Keycloak authenticator to the rest of the stack.

Highlights

• Drop-in Keycloak 26.x Authenticator SPI — no fork of Keycloak required
• OTP delivery over WhatsApp via the official Meta Cloud API
• No SMS gateway, no per-message carrier fees
• Configurable code length, expiry and retry limits per realm

Outcome

Realms running wa2fa get a second factor users already trust, delivered over infrastructure they already have running, with OTP costs collapsing to the Meta Cloud API's messaging rate instead of a per-SMS carrier fee.