New Passkey Step When Connecting WhatsApp
WhatsApp is introducing an additional Passkey confirmation step when linking devices. This article explains what changed and how Whapi.Cloud is adapting its API to support the new authorization flow.
WhatsApp is gradually introducing an additional security step when linking WhatsApp Web and other companion devices.
For some accounts, scanning the QR code is no longer enough to complete the connection. The phone may display “Continue on WhatsApp Web”, after which the user must confirm the connection with a Passkey in the browser.
This feature is being rolled out gradually and does not currently affect every account. WhatsApp has not yet published full technical details about its final behavior or rollout scope.
What is a Passkey?
A Passkey is a secure way to confirm your identity without entering a password or SMS code. Depending on the device, confirmation may use:
fingerprint or face recognition;
device PIN;
Windows Hello;
Touch ID;
a system credential or password manager.
Passkeys use cryptographic keys. The private key remains on the user’s device or in their credential manager and is never entered manually or shared with Whapi.Cloud.
During authorization, the device signs a one-time request, and WhatsApp verifies the response.
Why is this step required?
The additional confirmation helps WhatsApp verify that the connection is being approved by the account owner and reduces the risk of unauthorized device linking.
For affected accounts, the QR code starts the connection process, while the Passkey confirmation completes it.
How this affects Whapi.Cloud authorization
The new WhatsApp flow requires a browser-based WebAuthn operation. WebAuthn is the standard used by browsers to interact with Windows Hello, Touch ID, device PINs, and other system authenticators.
This operation cannot be replaced with a permanent code or pre-generated token. Each authorization attempt uses a new challenge and requires confirmation in a trusted browser environment.
Our team is actively adapting Whapi.Cloud to support this new authorization flow. We are currently developing automated options, including AutoPasskey and Chrome Passkey.
While these options are still in development, users can complete authorization through Manual Paste.
What is Manual Paste?
Manual Paste is a temporary manual method for transferring the result of the Passkey confirmation from the browser to Whapi.Cloud.
Whapi.Cloud provides a ready-to-use script. The user runs it in the browser console on web.whatsapp.com, completes the standard Passkey confirmation, and pastes the returned result back into the Whapi.Cloud interface.
Manual Paste does not bypass WhatsApp security. The Passkey operation is still performed by the browser and the user’s operating system.
How to complete authorization with Manual Paste
Start connecting your WhatsApp number and scan the standard QR code.
If WhatsApp requests additional confirmation, select Manual Paste in Whapi.Cloud.
Copy the script shown in the interface.
Open web.whatsapp.com in Google Chrome.
Open the browser console:
Windows or Linux:
F12orCtrl + Shift + J;macOS:
Command + Option + J.
Open the Console tab, paste the script, and press
Enter.If Chrome blocks pasting into the Console, type
allow pastingmanually and press Enter. Then paste the script again and press Enter.Complete the Passkey, Windows Hello, Touch ID, PIN, or other system confirmation.
After successful confirmation, a long JSON response will appear in the console.
Copy the complete JSON response without changing it.
Return to Whapi.Cloud, paste it into the provided field, and submit it.
Whapi.Cloud will send this one-time response to WhatsApp, and the authorization process will continue.
Is Manual Paste secure?
Manual Paste does not send Whapi.Cloud your password, biometric data, device PIN, or private Passkey.
The Passkey remains on your device or in your credential manager.
Biometric data and PIN codes are processed by the operating system.
Whapi.Cloud receives only the result of the current authorization request.
This result is not a permanent credential and cannot be reused for another session.
The script must run on web.whatsapp.com, because the confirmation requires the correct WhatsApp browser context.
Only use the script provided directly in the Whapi.Cloud interface. Do not modify or share the returned JSON, and never run scripts received from third parties.
Why is a manual step currently required?
Passkey confirmation depends on a one-time WhatsApp challenge, the correct web domain, a browser session, a system authenticator, and explicit user approval.
Because these operations cannot be completed through a standard server-side API request alone, Manual Paste currently connects the browser confirmation step with the Whapi.Cloud authorization process.
What happens next?
We are continuing to analyze the new WhatsApp linking flow and develop automated Passkey authorization.
Our goal is to reduce the number of manual steps and make account connection as simple as the previous QR-only process. Until the automated options are ready, Manual Paste provides a working way to complete the new authorization step.
Because WhatsApp is still rolling out and adjusting this feature, the interface and sequence of steps may change as new technical details become available.
Last updated