<p>MksDdn Reddy Auth provides OTP-based authentication with:</p>
<ul>
<li>WordPress cookie session login for the frontend (shortcode, or REST with <code>issue_session: true</code>).</li>
<li>Optional Bearer token issuing for REST clients (<code>issue_token: true</code>; cookie not set by default on REST login).</li>
<li>Rate limiting and one-time OTP verification.</li>
<li>Optional site and REST API protection for unauthenticated visitors.</li>
<li>Optional allowed request sources (Origin/Referer) for plugin REST endpoints.</li>
</ul>
<p>The plugin maps each Reddy ID to a WordPress user and can create an account automatically on first successful login.</p>
<h3>Getting Started</h3>
<h4>1. Configure the Reddy bot token</h4>
<p>For production, define the token in <code>wp-config.php</code>:</p>
<pre><code>define( 'MKSDDN_REDDY_BOT_TOKEN', 'your-bot-token' );
</code></pre>
<p>For local development you can store the token in <strong>Settings > Reddy Auth</strong> instead. Use <strong>Bot connection test</strong> to verify delivery to a Reddy user.</p>
<h4>2. Set up the login page</h4>
<p>Create a WordPress page (for example, <code>/login/</code>) and insert:</p>
<pre><code>[mksddn_reddy_login]
</code></pre>
<p>Users enter their Reddy ID, receive a one-time code in Reddy, and sign in through the form.</p>
<h4>3. Review protection settings</h4>
<p>By default, both protection options are <strong>disabled</strong> so your site stays accessible after activation. Enable them only after the login page is configured:</p>
<ul>
<li><strong>Protect site content</strong> — redirects unauthenticated visitors to the login page.</li>
<li><strong>Protect all REST API content</strong> — returns <code>401</code> for protected REST routes.</li>
</ul>
<p>Public auth routes remain available without login:</p>
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/send-code</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/login</code></li>
<li><code>GET /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/complete-intent</code></li>
</ul>
<p>Webhook callback route is also public for BotMother integration:</p>
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/button-callback</code></li>
</ul>
<h4>4. Use REST API for headless clients</h4>
<p>Typical flow:</p>
<ol>
<li><code>POST /auth/send-code</code> with <code>{ "reddy_id": "123456" }</code></li>
<li><code>POST /auth/login</code> with <code>{ "reddy_id": "123456", "code": "111111", "issue_token": true }</code> for headless clients. Add <code>"issue_session": true</code> only when the browser must also receive a WordPress cookie (same-origin SPA).</li>
<li>Call protected REST routes with <code>Authorization: Bearer <token></code>.</li>
<li><code>GET /auth/me</code> to read the current user (Bearer or cookie session).</li>
<li><code>POST /auth/logout</code> to end the cookie session and revoke the Bearer token when provided.</li>
</ol>
<p>One-click flow:</p>
<ol>
<li><code>POST /auth/send-code</code> returns <code>intent_id</code> and <code>intent_secret</code> when one-click is enabled.</li>
<li>Poll <code>GET|POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code>.</li>
<li>After approval, finalize auth via <code>POST /auth/complete-intent</code> with <code>intent_id</code>, <code>intent_secret</code>, and optional <code>issue_token</code> / <code>issue_session</code>.</li>
</ol>
<p>For one-click polling, <code>intent-status</code> supports both:</p>
<ul>
<li><code>GET /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> query params.</li>
<li><code>POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> in JSON body.</li>
</ul>
<p><strong>Protect site content</strong> checks the WordPress cookie session (shortcode login or REST login with <code>issue_session: true</code>). It does not accept Bearer tokens. <strong>Protect all REST API content</strong> requires a Bearer token and ignores cookie-only sessions.</p>
<p>Download OpenAPI and Postman files from <strong>Settings > Reddy Auth > Developer Resources</strong>.</p>
<h4>5. Optional: restrict REST callers by browser source</h4>
<p>In <strong>Settings > Reddy Auth</strong>, <strong>Allowed request sources</strong> limits plugin REST traffic (<code>/mksddn-reddy-auth/v1/*</code>) to listed <code>Origin</code> or <code>Referer</code> URLs. Leave empty to allow any client (recommended for server-to-server integrations). This is a soft guard for browser apps, not a secret key.</p>
<h4>6. Optional: harden one-click webhook verification</h4>
<p>In <strong>Settings > Reddy Auth > One-Click Authorization</strong>, set <strong>Webhook secret (optional)</strong> to match BotMother webhook Secret.</p>
<ul>
<li>With a configured secret, webhook signature verification uses <code>sha256(body + bot_token + "." + webhook_secret)</code>.</li>
<li>With an empty secret, compatibility mode uses <code>sha256(body + bot_token)</code>.</li>
</ul>
<h3>External services</h3>
<p>This plugin connects to the <strong>Reddy bot API</strong> at <code>https://bot.reddy.team</code> to deliver one-time passwords and optional admin connection test messages.</p>
<p><strong>What the service is used for</strong></p>
<ul>
<li>Deliver OTP codes to a Reddy user during login.</li>
<li>Send an optional admin “bot connection test” message from <strong>Settings > Reddy Auth</strong>.</li>
</ul>
<p><strong>What data is sent and when</strong></p>
<ul>
<li><strong>OTP send / login:</strong> Reddy user ID (<code>userKey</code>) and message text containing the one-time code (and expiry hint). Message text is configurable in <strong>Settings > Reddy Auth > Bot Messages</strong> (placeholders <code>{code}</code>, <code>{ttl}</code>). Sent when a user requests a code via the login form or REST API.</li>
<li><strong>Bot connection test:</strong> Reddy user ID (<code>userKey</code>) and a configurable test message from <strong>Settings > Reddy Auth > Bot Messages</strong>. Sent only when an administrator runs <strong>Bot connection test</strong> in <strong>Settings > Reddy Auth</strong>.</li>
<li><strong>Bot token:</strong> Your bot token is included in the API request URL path (configured via <code>MKSDDN_REDDY_BOT_TOKEN</code> in <code>wp-config.php</code> or the development fallback field in settings). It is not sent to WordPress.org.</li>
</ul>
<p>Data is transmitted only when OTP delivery or the connection test is triggered. The plugin does not send site content, post data, or WordPress user passwords to Reddy.</p>
<p>This service is provided by Reddy: terms of use and privacy policy at https://help.reddy.team/pages/user-agreement</p>
<p>No other third-party services are required for core plugin operation.</p>


MksDdn Reddy Auth

Authenticate WordPress users via Reddy OTP flow for monolith and REST API clients.

Lalit Yadav

sumitkamboj53

<p>This plugin enhances the default WordPress login security by adding a One-Time Password (OTP) verification step via email:</p>
<ul>
<li>Users log in with their regular email/username and password.</li>
<li>If credentials are valid, an OTP is generated and emailed to the user.</li>
<li>A popup is shown on the same login page (<code>wp-login.php</code>) to enter the OTP.</li>
<li>Once the correct OTP is entered, the user is logged in.</li>
</ul>
<p>To help you get started, there’s a comprehensive video tutorial available that guides you through the process of setting.<br />
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/AZ6w1lkltOI?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p>
<h3>Features</h3>
<ul>
<li>Secure login via OTP sent to user’s email.</li>
<li>Role-based OTP enforcement.</li>
<li>Uses native wp-login.php form — no custom forms required.</li>
<li>Session-based OTP handling for security.</li>
<li>Expiring OTP (default: 40 seconds).</li>
<li>No third-party dependencies.</li>
</ul>
<h3>Donate</h3>
<p>If you find this plugin useful and want to support its development, you can make a donation via the following link:</p>
<p><a href="https://donate.stripe.com/3cI5kE7sv6ex30s5LB5kk2x" rel="nofollow ugc">Donate Here</a></p>
<p>Your donation helps to ensure that this plugin remains free and receives regular updates!</p>
<h3>Credits</h3>
<p>The plugin development was supported by [webnotics], [sumitkamboj53]. Contributions and feedback are always welcome.</p>
<h3>Documentation and Support</h3>
<p><strong><a href="https://webnotics.org/email-otp-login-with-default-login-form/" title="documentation" rel="nofollow ugc">Documentation</a></strong><br />
For detailed documentation, visit https://webnotics.org/email-otp-login-with-default-login-form/<br />
For support, please contact us at <a href="mailto:support@webnotics.solutions" rel="nofollow ugc">support@webnotics.solutions</a>.</p>
<h3>License</h3>
<p>This plugin is licensed under the GPLv2 or later.</p>


Email OTP Login with default login form


A highly trusted plugin for adding OTP verification to login. It supports both email.






Best plugin for login with email otp

Adds email OTP (One-Time Password) verification after valid login credentials on the default wp-login.php form for added security.

MksDdn Reddy Auth vs Email OTP Login with default login form