AuthEngine
The OTP Engine
SMS OTPs cost money and take time to get approval and docs verifications. WhatsApp reaches every user instantly. I gave the product team a secure, self-hosted microservice that delivers login OTPs over WhatsApp — with enterprise-grade auth, resilient sessions, and a 512MB-deployable footprint, this can't be a full-time solution but we can use this to pull up a small system under a company or an mvp testing product for 2-3 cities easily.
Most teams still verify users through expensive SMS gateways with per-message fees and slow carrier routes. I've conceptualized a 'scan once, verify forever' model — a self-hosted WhatsApp delivery layer that turns a phone's Linked Devices into a zero-cost, sub-second OTP channel, fully wrapped in an authenticated REST API, which is really helpful in the specialized scenarios for development and small-scale productions.
The Challenge
The Bottleneck
The product needed phone-number verification for login, but the existing options were painful: SMS gateways burned budget per message, third-party OTP SaaS shipped shared pools of phone numbers with latency spikes, and WhatsApp's official Business API required a lengthy verification process. There was no secure, self-hosted path from a server to a user's WhatsApp inbox.
The Solution
The Reality
I built a 'living' delivery engine. I engineered a production-ready microservice that boots a headless WhatsApp Web client, exposes a QR pairing flow, persists sessions to disk so it never re-authenticates, and exposes a JWT-protected /send-otp endpoint that generates cryptographically secure codes and delivers them in seconds.
"I didn't just build a message sender; I engineered a self-healing delivery pipeline that translates a phone's QR scan into a permanent, low-cost authentication channel."
Under the Hood
Technical Execution
A breakdown of the core systems engineered to deliver reliability and security.
Performance First
- Engineered aggressive Puppeteer flags (--js-flags=--max-old-space-size=200, --renderer-process-limit=1) to squeeze the WhatsApp client into 512MB cloud memory.
- Built a watchdog on the loading_screen event to detect and surface stuck Chrome sessions at 45 seconds.
- Achieved ~2-5 second OTP delivery with a 256MB V8 heap cap for the Node process.
Resilient Sessions
- Wired LocalAuth with a fixed clientId so a linked phone persists across restarts — zero QR re-scans on redeploys.
- Implemented a watchdog timeout (authTimeoutMs: 0) tuned for slow Railway/Render cold starts.
- Added automatic Puppeteer executable detection and cache-path fallback for containerized platforms.
Security-First Scale
- Leveraged TypeScript strict mode and Joi schemas to validate every request and env var at boot.
- Layered rate limiting, Helmet headers, CORS allow-lists, and full audit logging with masked phone numbers.
- Generated OTPs with crypto.randomInt and shipped graceful shutdown and request-ID correlation.
Want to try it?
Just let me know! →The Outcome.
AuthEngine went from a broken, manual SMS workflow to a live self-hosted service streaming OTPs over WhatsApp — paired, persisted, and shipped in 1 week.
- Sub-Second Delivery
- Zero Re-Scans
- Enterprise Security
- One-Command Deploy
What I learned
This project taught me that scope is a feature.
A week of focused scope out-ships a month of imagined requirements.
The right tool doesn't chase the newest channel — it meets the user where they already are.