Two step verification on a WhatsApp number

When is the PIN actually needed?

During registration and re-registration of a number, and in certain account operations that Meta guards.

That means most businesses set it during onboarding and never see it again, which is precisely why it becomes a problem. The person who set it moves on, the PIN was never recorded anywhere, and it is needed eighteen months later at the exact moment something is already broken.

The errors around it are specific enough to diagnose. An incorrect PIN returns 133005. Too many attempts returns 133008 and locks further tries for a period stated in the response. Attempts submitted too quickly return 133009, which is a rate limit rather than a wrong answer.

What do you do when it is lost?

Reset it in WhatsApp Manager, on the number's settings, which requires access to the account that owns it.

This is a business owner operation rather than a provider one. No API can read or reset a PIN, and no provider holds it, which is by design: a credential a provider could retrieve would not be a second factor.

The practical advice is to record it somewhere the business itself can retrieve, not the agency. A PIN stored only in an agency's password manager creates exactly the same problem one client relationship later.

Common mistakes

• Retrying quickly after a wrong PIN. That returns 133009 and delays the next legitimate attempt.
• Storing the PIN only on the agency side. The business needs to be able to retrieve it themselves.
• Assuming a provider can recover it. Nobody holds it, which is the point of it existing.

Frequently asked questions

Keep reading