MksDdn Reddy Auth provides OTP-based authentication with:
<ul>
<li>WordPress cookie session login for the frontend (shortcode, or REST with <code>issue_session: true</code>).</li>
<li>Optional Bearer token issuing for REST clients (<code>issue_token: true</code>; cookie not set by default on REST login).</li>
<li>Rate limiting and one-time OTP verification.</li>
<li>Optional site and REST API protection for unauthenticated visitors.</li>
<li>Optional allowed request sources (Origin/Referer) for plugin REST endpoints.</li>
</ul>
The plugin maps each Reddy ID to a WordPress user and can create an account automatically on first successful login.
<h3>Getting Started</h3>
<h4>1. Configure the Reddy bot token</h4>
For production, define the token in <code>wp-config.php</code>:
<pre><code>define( 'MKSDDN_REDDY_BOT_TOKEN', 'your-bot-token' );
</code></pre>
For local development you can store the token in Settings > Reddy Auth instead. Use Bot connection test to verify delivery to a Reddy user.
<h4>2. Set up the login page</h4>
Create a WordPress page (for example, <code>/login/</code>) and insert:
<pre><code>[mksddn_reddy_login]
</code></pre>
Users enter their Reddy ID, receive a one-time code in Reddy, and sign in through the form.
<h4>3. Review protection settings</h4>
By default, both protection options are disabled so your site stays accessible after activation. Enable them only after the login page is configured:
<ul>
<li>Protect site content — redirects unauthenticated visitors to the login page.</li>
<li>Protect all REST API content — returns <code>401</code> for protected REST routes.</li>
</ul>
Public auth routes remain available without login:
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/send-code</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/login</code></li>
<li><code>GET /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/complete-intent</code></li>
</ul>
Webhook callback route is also public for BotMother integration:
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/button-callback</code></li>
</ul>
<h4>4. Use REST API for headless clients</h4>
Typical flow:
<ol>
<li><code>POST /auth/send-code</code> with <code>{ "reddy_id": "123456" }</code></li>
<li><code>POST /auth/login</code> with <code>{ "reddy_id": "123456", "code": "111111", "issue_token": true }</code> for headless clients. Add <code>"issue_session": true</code> only when the browser must also receive a WordPress cookie (same-origin SPA).</li>
<li>Call protected REST routes with <code>Authorization: Bearer <token></code>.</li>
<li><code>GET /auth/me</code> to read the current user (Bearer or cookie session).</li>
<li><code>POST /auth/logout</code> to end the cookie session and revoke the Bearer token when provided.</li>
</ol>
One-click flow:
<ol>
<li><code>POST /auth/send-code</code> returns <code>intent_id</code> and <code>intent_secret</code> when one-click is enabled.</li>
<li>Poll <code>GET|POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code>.</li>
<li>After approval, finalize auth via <code>POST /auth/complete-intent</code> with <code>intent_id</code>, <code>intent_secret</code>, and optional <code>issue_token</code> / <code>issue_session</code>.</li>
</ol>
For one-click polling, <code>intent-status</code> supports both:
<ul>
<li><code>GET /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> query params.</li>
<li><code>POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> in JSON body.</li>
</ul>
Protect site content checks the WordPress cookie session (shortcode login or REST login with <code>issue_session: true</code>). It does not accept Bearer tokens. Protect all REST API content requires a Bearer token and ignores cookie-only sessions.
Download OpenAPI and Postman files from Settings > Reddy Auth > Developer Resources.
<h4>5. Optional: restrict REST callers by browser source</h4>
In Settings > Reddy Auth, Allowed request sources limits plugin REST traffic (<code>/mksddn-reddy-auth/v1/*</code>) to listed <code>Origin</code> or <code>Referer</code> URLs. Leave empty to allow any client (recommended for server-to-server integrations). This is a soft guard for browser apps, not a secret key.
<h4>6. Optional: harden one-click webhook verification</h4>
In Settings > Reddy Auth > One-Click Authorization, set Webhook secret (optional) to match BotMother webhook Secret.
<ul>
<li>With a configured secret, webhook signature verification uses <code>sha256(body + bot_token + "." + webhook_secret)</code>.</li>
<li>With an empty secret, compatibility mode uses <code>sha256(body + bot_token)</code>.</li>
</ul>
<h3>External services</h3>
This plugin connects to the Reddy bot API at <code>https://bot.reddy.team</code> to deliver one-time passwords and optional admin connection test messages.
What the service is used for
<ul>
<li>Deliver OTP codes to a Reddy user during login.</li>
<li>Send an optional admin “bot connection test” message from Settings > Reddy Auth.</li>
</ul>
What data is sent and when
<ul>
<li>OTP send / login: Reddy user ID (<code>userKey</code>) and message text containing the one-time code (and expiry hint). Message text is configurable in Settings > Reddy Auth > Bot Messages (placeholders <code>{code}</code>, <code>{ttl}</code>). Sent when a user requests a code via the login form or REST API.</li>
<li>Bot connection test: Reddy user ID (<code>userKey</code>) and a configurable test message from Settings > Reddy Auth > Bot Messages. Sent only when an administrator runs Bot connection test in Settings > Reddy Auth.</li>
<li>Bot token: Your bot token is included in the API request URL path (configured via <code>MKSDDN_REDDY_BOT_TOKEN</code> in <code>wp-config.php</code> or the development fallback field in settings). It is not sent to WordPress.org.</li>
</ul>
Data is transmitted only when OTP delivery or the connection test is triggered. The plugin does not send site content, post data, or WordPress user passwords to Reddy.
This service is provided by Reddy: terms of use and privacy policy at https://help.reddy.team/pages/user-agreement
No other third-party services are required for core plugin operation.

MksDdn Reddy Auth

Authenticate WordPress users via Reddy OTP flow for monolith and REST API clients.

Hamid Alinia

Enable OTP login for WordPress that supports WooCommerce using phone numbers, SMS, or WhatsApp. Secure passwordless login with custom gateways and GDPR compliance.
Login/register with phone number in WordPress can happen with this plugin. Your customer can authenticate with their mobile number via OTP.
Added country flags to login with phone number form
You can add almost every SMS gateways (if you have) yourself for free, or you can ask us to develop your sms gateway with paying extra.
you can change style and appearance of forms
You can use Firebase, textlocal and other SMS gateways
For checking docs and getting more help please visit: 
<a href="https://idehweb.com/product/login-with-phone-number-in-wordpress/" title="login with phone number in WordPress" rel="nofollow ugc">Login with phone number in WordPress documentations</a>
<ul>
<li>
Login with phone number in WordPress
</li>
<li>
Login with OTP WordPress
</li>
<li>
Login with mobile number WordPress
</li>
<li>
Login/Register with E-mail
</li>
<li>
WordPress Login Form
</li>
<li>
Woocommerce Registration Form
</li>
<li>
Woocommerce Login With Phone Number
</li>
<li>
WordPress OTP Login
</li>
<li>
Woocommerce Registration With Phone Number
</li>
<li>
Add Phone Number to WordPress Registration
</li>
<li>
Simple Use
</li>
<li>
Support of International SMS Delivery
</li>
<li>
Activating Users by Phone Number
</li>
<li>
Password Recovery Form
</li>
<li>
Page Authentication in Order to Visit Pages
</li>
<li>
Login and Registration with Phone Number
</li>
<li>
Redirect Users to Specific URLs After Logging in or Registering
</li>
</ul>
You can use your custom gateway. you can also use other ready sms gateways from idehweb.com.
Supported gateways for now:
<ul>
<li>Firebase – Free</li>
<li>Msg91</li>
<li>Twilio</li>
<li>Netgsm</li>
<li>Alibabacloud</li>
<li>Messagebird</li>
<li>Kavenegar</li>
<li>Trustsignal</li>
<li>taqnyat</li>
<li>2factor</li>
<li>Textlocal</li>
<li>BlueSoft</li>
<li>IQSMS</li>
<li>Whatsapp</li>
<li>Ultramessage</li>
<li>Telegram</li>
<li>Ippanel</li>
<li>Sms.ir</li>
<li>MelliPayamak</li>
<li>Farazsms</li>
</ul>
You can now choose to store phone numbers with or without the country code.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/0B0sE9JMzCE?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h3>External Services</h3>
This plugin uses external services to provide chat support and analyze user behavior. Below is the list of services used and what data is sent:
<ol>
<li>Crisp Chat</li>
</ol>
– Used to provide live chat functionality within the plugin for user support. 
– Data sent: user chat messages, name, email, IP address. 
– Service provider: Crisp IM SARL 
– Terms of Service: https://crisp.chat/en/terms/ 
– Privacy Policy: https://crisp.chat/en/privacy/
<ol>
<li>Microsoft Clarity</li>
</ol>
– Used for user behavior analytics to understand how users interact with the plugin’s administrative pages. 
– Data sent: user interactions like mouse movements, clicks, and scrolling. Personally identifiable information (PII) is masked. 
– Service provider: Microsoft 
– Terms of Service: https://clarity.microsoft.com/terms 
– Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement
<ol>
<li>Firebase Authentication</li>
</ol>
– Used to verify users’ phone numbers with OTP for secure authentication. 
– Data sent: phone number and verification requests. IP addresses are used for security and abuse prevention. 
– Service provider: Google Firebase 
– Terms of Service: https://firebase.google.com/terms 
– Privacy Policy: https://firebase.google.com/support/privacy

OTP Login With Phone Number, OTP Verification

1. Shows ads.
2. Shows developers real face in my admin dashboard :|
3. The core basic functionality (connection to KaveNegar SMS service provider) is locked behind Pro version. Almost all SMS gateways are locked behind a paywall.
4. "Enable usage tracking" option checked by default (without users knowladge).

Shows Ads and Needs Pro Version!

OTP login with phone, SMS, or WhatsApp. OTP verification for WordPress & WooCommerce using custom gateways. GDPR-compliant. Login with otp

MksDdn Reddy Auth vs OTP Login With Phone Number, OTP Verification