<p>MksDdn Reddy Auth provides OTP-based authentication with:</p>
<ul>
<li>WordPress cookie session login for the frontend (shortcode, or REST with <code>issue_session: true</code>).</li>
<li>Optional Bearer token issuing for REST clients (<code>issue_token: true</code>; cookie not set by default on REST login).</li>
<li>Rate limiting and one-time OTP verification.</li>
<li>Optional site and REST API protection for unauthenticated visitors.</li>
<li>Optional allowed request sources (Origin/Referer) for plugin REST endpoints.</li>
</ul>
<p>The plugin maps each Reddy ID to a WordPress user and can create an account automatically on first successful login.</p>
<h3>Getting Started</h3>
<h4>1. Configure the Reddy bot token</h4>
<p>For production, define the token in <code>wp-config.php</code>:</p>
<pre><code>define( 'MKSDDN_REDDY_BOT_TOKEN', 'your-bot-token' );
</code></pre>
<p>For local development you can store the token in <strong>Settings > Reddy Auth</strong> instead. Use <strong>Bot connection test</strong> to verify delivery to a Reddy user.</p>
<h4>2. Set up the login page</h4>
<p>Create a WordPress page (for example, <code>/login/</code>) and insert:</p>
<pre><code>[mksddn_reddy_login]
</code></pre>
<p>Users enter their Reddy ID, receive a one-time code in Reddy, and sign in through the form.</p>
<h4>3. Review protection settings</h4>
<p>By default, both protection options are <strong>disabled</strong> so your site stays accessible after activation. Enable them only after the login page is configured:</p>
<ul>
<li><strong>Protect site content</strong> — redirects unauthenticated visitors to the login page.</li>
<li><strong>Protect all REST API content</strong> — returns <code>401</code> for protected REST routes.</li>
</ul>
<p>Public auth routes remain available without login:</p>
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/send-code</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/login</code></li>
<li><code>GET /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/complete-intent</code></li>
</ul>
<p>Webhook callback route is also public for BotMother integration:</p>
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/button-callback</code></li>
</ul>
<h4>4. Use REST API for headless clients</h4>
<p>Typical flow:</p>
<ol>
<li><code>POST /auth/send-code</code> with <code>{ "reddy_id": "123456" }</code></li>
<li><code>POST /auth/login</code> with <code>{ "reddy_id": "123456", "code": "111111", "issue_token": true }</code> for headless clients. Add <code>"issue_session": true</code> only when the browser must also receive a WordPress cookie (same-origin SPA).</li>
<li>Call protected REST routes with <code>Authorization: Bearer <token></code>.</li>
<li><code>GET /auth/me</code> to read the current user (Bearer or cookie session).</li>
<li><code>POST /auth/logout</code> to end the cookie session and revoke the Bearer token when provided.</li>
</ol>
<p>One-click flow:</p>
<ol>
<li><code>POST /auth/send-code</code> returns <code>intent_id</code> and <code>intent_secret</code> when one-click is enabled.</li>
<li>Poll <code>GET|POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code>.</li>
<li>After approval, finalize auth via <code>POST /auth/complete-intent</code> with <code>intent_id</code>, <code>intent_secret</code>, and optional <code>issue_token</code> / <code>issue_session</code>.</li>
</ol>
<p>For one-click polling, <code>intent-status</code> supports both:</p>
<ul>
<li><code>GET /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> query params.</li>
<li><code>POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> in JSON body.</li>
</ul>
<p><strong>Protect site content</strong> checks the WordPress cookie session (shortcode login or REST login with <code>issue_session: true</code>). It does not accept Bearer tokens. <strong>Protect all REST API content</strong> requires a Bearer token and ignores cookie-only sessions.</p>
<p>Download OpenAPI and Postman files from <strong>Settings > Reddy Auth > Developer Resources</strong>.</p>
<h4>5. Optional: restrict REST callers by browser source</h4>
<p>In <strong>Settings > Reddy Auth</strong>, <strong>Allowed request sources</strong> limits plugin REST traffic (<code>/mksddn-reddy-auth/v1/*</code>) to listed <code>Origin</code> or <code>Referer</code> URLs. Leave empty to allow any client (recommended for server-to-server integrations). This is a soft guard for browser apps, not a secret key.</p>
<h4>6. Optional: harden one-click webhook verification</h4>
<p>In <strong>Settings > Reddy Auth > One-Click Authorization</strong>, set <strong>Webhook secret (optional)</strong> to match BotMother webhook Secret.</p>
<ul>
<li>With a configured secret, webhook signature verification uses <code>sha256(body + bot_token + "." + webhook_secret)</code>.</li>
<li>With an empty secret, compatibility mode uses <code>sha256(body + bot_token)</code>.</li>
</ul>
<h3>External services</h3>
<p>This plugin connects to the <strong>Reddy bot API</strong> at <code>https://bot.reddy.team</code> to deliver one-time passwords and optional admin connection test messages.</p>
<p><strong>What the service is used for</strong></p>
<ul>
<li>Deliver OTP codes to a Reddy user during login.</li>
<li>Send an optional admin “bot connection test” message from <strong>Settings > Reddy Auth</strong>.</li>
</ul>
<p><strong>What data is sent and when</strong></p>
<ul>
<li><strong>OTP send / login:</strong> Reddy user ID (<code>userKey</code>) and message text containing the one-time code (and expiry hint). Message text is configurable in <strong>Settings > Reddy Auth > Bot Messages</strong> (placeholders <code>{code}</code>, <code>{ttl}</code>). Sent when a user requests a code via the login form or REST API.</li>
<li><strong>Bot connection test:</strong> Reddy user ID (<code>userKey</code>) and a configurable test message from <strong>Settings > Reddy Auth > Bot Messages</strong>. Sent only when an administrator runs <strong>Bot connection test</strong> in <strong>Settings > Reddy Auth</strong>.</li>
<li><strong>Bot token:</strong> Your bot token is included in the API request URL path (configured via <code>MKSDDN_REDDY_BOT_TOKEN</code> in <code>wp-config.php</code> or the development fallback field in settings). It is not sent to WordPress.org.</li>
</ul>
<p>Data is transmitted only when OTP delivery or the connection test is triggered. The plugin does not send site content, post data, or WordPress user passwords to Reddy.</p>
<p>This service is provided by Reddy: terms of use and privacy policy at https://help.reddy.team/pages/user-agreement</p>
<p>No other third-party services are required for core plugin operation.</p>


MksDdn Reddy Auth

Authenticate WordPress users via Reddy OTP flow for monolith and REST API clients.

YoOhw Studio

<p>Advanced Accounts for WooCommerce helps store owners improve the WooCommerce My Account experience with account verification, OTP login, password reset by OTP, and membership content access.</p>
<p>Use it to make customer accounts easier to manage, reduce fake registrations, verify phone or email ownership, and show selected content only to the right customers.</p>
<p><a href="https://yoohw.com/product/woocommerce-advanced-accounts-premium/" rel="nofollow ugc">Premium version</a> | <a href="https://docs.yoohw.com/category/woocommerce-advanced-accounts-premium/" rel="nofollow ugc">Documentation</a> | <a href="https://yoohw.com/support/" rel="nofollow ugc">Support</a> | <a href="https://sandbox.yoohw.com/demo/wcaa_demo.html" rel="nofollow ugc">Demo</a></p>
<h4>WooCommerce My Account Customization</h4>
<p>Improve the customer account area without editing theme templates. You can manage WooCommerce account behavior from plugin settings and keep the experience aligned with your store.</p>
<p>Free account features include:</p>
<ul>
<li>Redirect the default WordPress login page to WooCommerce My Account.</li>
<li>Support phone number based account login.</li>
<li>Disable email requirement when using phone-first registration.</li>
<li>Keep checkout and account login flows connected to WooCommerce.</li>
<li>Migrate existing customer usernames to phone-number based usernames with dry-run and batch controls.</li>
</ul>
<p>Premium account customization features include:</p>
<ul>
<li>Add custom My Account endpoints.</li>
<li>Customize endpoint labels, slugs, icons, order, and visibility.</li>
<li>Show account tabs only to selected roles or membership levels.</li>
<li>Add profile photos and extra registration fields.</li>
<li>Block or unblock customer accounts without deleting user data.</li>
</ul>
<h4>OTP Login and Account Verification</h4>
<p>Add secure one-time password flows for WooCommerce customers. The plugin supports OTP login, account registration verification, and password reset verification by phone or email.</p>
<p>Verification features include:</p>
<ul>
<li>WooCommerce OTP login by phone or email.</li>
<li>Phone verification during account registration.</li>
<li>Email verification during account registration.</li>
<li>Password reset using OTP.</li>
<li>Server-side OTP expiration, failed attempt limits, resend cooldown, and resend limits.</li>
<li>Verified phone and email status for compatible checkout protection workflows.</li>
</ul>
<p>SMS delivery is available through Yo Credits in the free plugin. Twilio and Textmagic are available in the Premium version when explicitly enabled.</p>
<h4>Membership Content Access</h4>
<p>Create membership levels with WordPress roles and use them to control who can see selected content.</p>
<p>Free membership features include:</p>
<ul>
<li>Create and manage membership roles.</li>
<li>Use the <code>[yoaa_membership]</code> shortcode to show content to selected roles.</li>
<li>Show or hide shortcode content for logged-in users or guests.</li>
<li>Build simple member-only pages without a separate membership plugin.</li>
</ul>
<p>Premium membership features include:</p>
<ul>
<li>Restrict posts, pages, and WooCommerce products by membership level.</li>
<li>Create a membership products page.</li>
<li>Allow customers to hold multiple membership roles.</li>
<li>Show custom access notices for restricted content.</li>
<li>Offer membership-based product discounts.</li>
<li>Support WooCommerce Subscriptions for recurring membership plans.</li>
</ul>
<h4>Integrations</h4>
<p>Advanced Accounts for WooCommerce works with these related tools:</p>
<ul>
<li><a href="https://wordpress.org/plugins/wc-blacklist-manager/" rel="ugc">Blacklist Manager</a> – Recognizes verified phone numbers and email addresses during checkout checks.</li>
<li><a href="https://woocommerce.com/products/woocommerce-subscriptions/" rel="nofollow ugc">WooCommerce Subscriptions</a> – Premium membership plans can work with subscription products.</li>
<li><a href="https://yoohw.com/product/woocommerce-loyalty/" rel="nofollow ugc">WooCommerce Loyalty – Points and Rewards</a> – Premium membership roles can be used with loyalty rewards.</li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to third-party or external services only when the related feature is enabled or triggered by an administrator or customer action.</p>
<h4>Yo Credits</h4>
<p>Service: https://yoohw.com/product/sms-credits/</p>
<p>Yo Credits is used to generate a site SMS key, send OTP messages for phone verification, OTP login, checkout verification, and password reset, and update remaining SMS quota.</p>
<p>Requests may include:</p>
<ul>
<li>Site domain.</li>
<li>Administrator email when generating an SMS key.</li>
<li>SMS key.</li>
<li>Destination phone number.</li>
<li>OTP message content.</li>
</ul>
<h4>Twilio</h4>
<p>Service: https://www.twilio.com/</p>
<p>Twilio is an SMS provider available in the Premium version when explicitly enabled by the store administrator.</p>
<h4>Textmagic</h4>
<p>Service: https://www.textmagic.com/</p>
<p>Textmagic is an SMS provider available in the Premium version when explicitly enabled by the store administrator.</p>
<p>No visitor IP geolocation, product-news subscription, or catalog feed request is sent by the free plugin.</p>
<h3>Bundled Libraries</h3>
<ul>
<li>Font Awesome Free 6.7.2: bundled in <code>font/fontawesome/</code>. License details and source are available at https://fontawesome.com/license/free and https://github.com/FortAwesome/Font-Awesome.</li>
<li>International Telephone Input 29.0.5: bundled in <code>js/intl-tel-input/</code>, including UI locale data. License and source are available at https://github.com/jackocnr/intl-tel-input.</li>
</ul>


Advanced Accounts for WooCommerce

Customize WooCommerce My Account, add OTP login and verification, and control member-only content with roles.

MksDdn Reddy Auth vs Advanced Accounts for WooCommerce