WhatsApp error 133005: Two step verification PIN Mismatch

Code 133005 means the six-digit two-step verification PIN you supplied in a register call does not match the PIN set on the phone number. Every Cloud API phone number must be registered with a PIN, and once set, the same PIN is required for future registrations and migrations. If a different team member set the PIN, if it was changed in WhatsApp Manager, or if the number came from the WhatsApp Business app with a PIN the developer never knew, the register call fails with 133005.

This is safe to see once or twice, but be careful: repeated wrong guesses lead to 133008 (too many guesses), guesses in rapid succession lead to 133009, and a pattern of failures can contribute to an account lock (131031). Meta's documentation describes a reset path: disable two-step verification, then send a POST to the phone number endpoint with the new PIN.

Your token, number, and app are all fine; only the secret is wrong.

Treat the two-step PIN as a secret owned by the same system that owns the token: store it in a secrets manager as a string, document who can change it, and never rotate it without updating automation. Rate-limit registration attempts in your own code so a wrong PIN cannot escalate into 133008 or an account lock. The PIN reset sequence is part of the registration troubleshooting guide; the guess-limit and velocity blocks it can escalate into are 133008 and 133009.