MksDdn Reddy Auth provides OTP-based authentication with:
<ul>
<li>WordPress cookie session login for the frontend (shortcode, or REST with <code>issue_session: true</code>).</li>
<li>Optional Bearer token issuing for REST clients (<code>issue_token: true</code>; cookie not set by default on REST login).</li>
<li>Rate limiting and one-time OTP verification.</li>
<li>Optional site and REST API protection for unauthenticated visitors.</li>
<li>Optional allowed request sources (Origin/Referer) for plugin REST endpoints.</li>
</ul>
The plugin maps each Reddy ID to a WordPress user and can create an account automatically on first successful login.
<h3>Getting Started</h3>
<h4>1. Configure the Reddy bot token</h4>
For production, define the token in <code>wp-config.php</code>:
<pre><code>define( 'MKSDDN_REDDY_BOT_TOKEN', 'your-bot-token' );
</code></pre>
For local development you can store the token in Settings > Reddy Auth instead. Use Bot connection test to verify delivery to a Reddy user.
<h4>2. Set up the login page</h4>
Create a WordPress page (for example, <code>/login/</code>) and insert:
<pre><code>[mksddn_reddy_login]
</code></pre>
Users enter their Reddy ID, receive a one-time code in Reddy, and sign in through the form.
<h4>3. Review protection settings</h4>
By default, both protection options are disabled so your site stays accessible after activation. Enable them only after the login page is configured:
<ul>
<li>Protect site content — redirects unauthenticated visitors to the login page.</li>
<li>Protect all REST API content — returns <code>401</code> for protected REST routes.</li>
</ul>
Public auth routes remain available without login:
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/send-code</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/login</code></li>
<li><code>GET /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/complete-intent</code></li>
</ul>
Webhook callback route is also public for BotMother integration:
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/button-callback</code></li>
</ul>
<h4>4. Use REST API for headless clients</h4>
Typical flow:
<ol>
<li><code>POST /auth/send-code</code> with <code>{ "reddy_id": "123456" }</code></li>
<li><code>POST /auth/login</code> with <code>{ "reddy_id": "123456", "code": "111111", "issue_token": true }</code> for headless clients. Add <code>"issue_session": true</code> only when the browser must also receive a WordPress cookie (same-origin SPA).</li>
<li>Call protected REST routes with <code>Authorization: Bearer <token></code>.</li>
<li><code>GET /auth/me</code> to read the current user (Bearer or cookie session).</li>
<li><code>POST /auth/logout</code> to end the cookie session and revoke the Bearer token when provided.</li>
</ol>
One-click flow:
<ol>
<li><code>POST /auth/send-code</code> returns <code>intent_id</code> and <code>intent_secret</code> when one-click is enabled.</li>
<li>Poll <code>GET|POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code>.</li>
<li>After approval, finalize auth via <code>POST /auth/complete-intent</code> with <code>intent_id</code>, <code>intent_secret</code>, and optional <code>issue_token</code> / <code>issue_session</code>.</li>
</ol>
For one-click polling, <code>intent-status</code> supports both:
<ul>
<li><code>GET /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> query params.</li>
<li><code>POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> in JSON body.</li>
</ul>
Protect site content checks the WordPress cookie session (shortcode login or REST login with <code>issue_session: true</code>). It does not accept Bearer tokens. Protect all REST API content requires a Bearer token and ignores cookie-only sessions.
Download OpenAPI and Postman files from Settings > Reddy Auth > Developer Resources.
<h4>5. Optional: restrict REST callers by browser source</h4>
In Settings > Reddy Auth, Allowed request sources limits plugin REST traffic (<code>/mksddn-reddy-auth/v1/*</code>) to listed <code>Origin</code> or <code>Referer</code> URLs. Leave empty to allow any client (recommended for server-to-server integrations). This is a soft guard for browser apps, not a secret key.
<h4>6. Optional: harden one-click webhook verification</h4>
In Settings > Reddy Auth > One-Click Authorization, set Webhook secret (optional) to match BotMother webhook Secret.
<ul>
<li>With a configured secret, webhook signature verification uses <code>sha256(body + bot_token + "." + webhook_secret)</code>.</li>
<li>With an empty secret, compatibility mode uses <code>sha256(body + bot_token)</code>.</li>
</ul>
<h3>External services</h3>
This plugin connects to the Reddy bot API at <code>https://bot.reddy.team</code> to deliver one-time passwords and optional admin connection test messages.
What the service is used for
<ul>
<li>Deliver OTP codes to a Reddy user during login.</li>
<li>Send an optional admin “bot connection test” message from Settings > Reddy Auth.</li>
</ul>
What data is sent and when
<ul>
<li>OTP send / login: Reddy user ID (<code>userKey</code>) and message text containing the one-time code (and expiry hint). Message text is configurable in Settings > Reddy Auth > Bot Messages (placeholders <code>{code}</code>, <code>{ttl}</code>). Sent when a user requests a code via the login form or REST API.</li>
<li>Bot connection test: Reddy user ID (<code>userKey</code>) and a configurable test message from Settings > Reddy Auth > Bot Messages. Sent only when an administrator runs Bot connection test in Settings > Reddy Auth.</li>
<li>Bot token: Your bot token is included in the API request URL path (configured via <code>MKSDDN_REDDY_BOT_TOKEN</code> in <code>wp-config.php</code> or the development fallback field in settings). It is not sent to WordPress.org.</li>
</ul>
Data is transmitted only when OTP delivery or the connection test is triggered. The plugin does not send site content, post data, or WordPress user passwords to Reddy.
This service is provided by Reddy: terms of use and privacy policy at https://help.reddy.team/pages/user-agreement
No other third-party services are required for core plugin operation.

MksDdn Reddy Auth

Authenticate WordPress users via Reddy OTP flow for monolith and REST API clients.

Mostafa Soufi

Navid Kashani

alifallahrn

VeronaLabs

Reza

<a href="https://wsms.io/?utm_source=wporg&utm_medium=link&utm_campaign=website" rel="nofollow ugc">WSMS</a> lets you send SMS/MMS notifications, one-time passwords (OTP), and two-factor authentication (2FA) messages straight from WordPress. It supports a wide range of SMS gateways and integrates with popular e-commerce and form builder plugins.
Use WSMS to: 
– Keep customers updated on WooCommerce orders 
– Collect subscribers with SMS newsletter forms 
– Secure logins with OTP & 2FA 
– Alert admins about new users, logins, or updates 
– Run marketing campaigns with scheduled or bulk SMS
👉 <a href="https://demo.wsms.io/wp-login.php" rel="nofollow ugc">Check out the demo</a> | <a href="#screenshots" rel="nofollow ugc">View screenshots</a> | <a href="https://wsms.io/gateways?utm_source=wporg&utm_medium=link&utm_campaign=gateways" rel="nofollow ugc">See supported gateways</a> | <a href="https://wsms.io/integrations?utm_source=wporg&utm_medium=link&utm_campaign=integrations" rel="nofollow ugc">Explore integrations</a> | <a href="https://wsms.io/docs/" rel="nofollow ugc">Documentation</a>
<h3>✨ Key Features</h3>
<ul>
<li>Send SMS/MMS: Send messages through your choice of supported SMS gateways.</li>
<li>E-Commerce & Form Integration: Seamlessly integrates with popular e-commerce platforms and form builders.</li>
<li>OTP & 2FA: Add extra login security with one-time passwords and two-factor authentication.</li>
<li>Mobile Login: Let users log in with their mobile number.</li>
<li>Admin Alerts: Get notified when new users register, posts are published, or WordPress updates are available.</li>
<li>Newsletters & Widgets: Build SMS newsletter forms with shortcodes, widgets, or Gutenberg blocks.</li>
<li>Two-Way SMS (All-in-One): Receive and reply to SMS messages inside WordPress.</li>
<li>Bulk & Scheduled SMS: Send to multiple recipients at once, immediately or on schedule.</li>
<li>Third-Party Integration: Connect with external services and automation platforms.</li>
<li>Messaging Button: Let visitors reach you instantly via messaging channels.</li>
<li>GDPR Compliant: Built with privacy and compliance in mind.</li>
</ul>
<h3>💎 Upgrade to WSMS All-in-One</h3>
Unlock additional features with All-in-One — the plan that gives you access to all premium add-ons in one package.
With All-in-One you get: 
– Secure login & registration with OTP & 2FA 
– Scheduled & recurring SMS/MMS 
– Two-way SMS inbox 
– Enhanced e-commerce features (login, checkout verification, order updates) 
– Membership platform integrations 
– Advanced form builder SMS capabilities 
– Marketing automation integrations 
– Booking system compatibility 
– URL shortening service integration 
– All future add-ons included
👉 <a href="https://wsms.io/pricing/?utm_source=wporg&utm_medium=link&utm_campaign=pricing" rel="nofollow ugc">See All-in-One details & compare features</a>
<h3>🐞 Report Bugs & Security</h3>
<ul>
<li>Found a bug? <a href="https://github.com/wp-sms/wp-sms/issues/new" rel="nofollow ugc">Open an issue on GitHub</a>.</li>
<li>Security concerns? Report them via the <a href="https://patchstack.com/database/wordpress/plugin/wp-sms/vdp" rel="nofollow ugc">Patchstack VDP program</a>.</li>
</ul>
<h3>📝 Trademark Notice</h3>
WooCommerce, GravityForms, Elementor, Contact Form 7, Twilio, WhatsApp, Clickatell, BulkSMS, Plivo, Zapier, Bitly, and other product names mentioned are trademarks of their respective owners. WSMS is not affiliated with, endorsed by, or sponsored by these companies.
<h3>Source Code and Build Instructions</h3>
Note: The plugin works out of the box — no build steps required for regular users. This section is for developers who want to modify or contribute to the source code. See the <a href="https://wsms.io/docs/" rel="nofollow ugc">full documentation</a> for user guides.
All source code for minified JavaScript and CSS is included in the plugin under the <code>resources/</code> directory. Build instructions and full source are available on <a href="https://github.com/wp-sms/wp-sms" rel="nofollow ugc">GitHub</a>.
<h4>Third-Party Libraries</h4>
<a href="https://github.com/chartjs/Chart.js" rel="nofollow ugc">Chart.js</a>, <a href="https://github.com/flatpickr/flatpickr" rel="nofollow ugc">flatpickr</a>, <a href="https://github.com/jackocnr/intl-tel-input" rel="nofollow ugc">intlTelInput</a>, <a href="https://github.com/DubFriend/jquery.repeater" rel="nofollow ugc">jquery.repeater</a>, <a href="https://github.com/qwertypants/jQuery-Word-and-Character-Counter-Plugin" rel="nofollow ugc">jQuery Word and Character Counter</a>, <a href="https://github.com/facebook/react" rel="nofollow ugc">React</a>, <a href="https://github.com/select2/select2" rel="nofollow ugc">Select2</a>, <a href="https://github.com/tailwindlabs/tailwindcss" rel="nofollow ugc">Tailwind CSS</a>, <a href="https://github.com/calebjacob/tooltipster" rel="nofollow ugc">Tooltipster</a>, <a href="https://github.com/veronalabs/wp-scoper" rel="nofollow ugc">WP Scoper</a>

WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce






many thanks to the development and support team



they worked hard and now i recommend everyone to buy this plugin



but if your are looking for more features like 2way sms and custom sms it is not the right choice for you










great plugin

Send SMS/MMS notifications, OTP & 2FA messages, and WooCommerce updates with support for multiple gateways and plugin integrations.

MksDdn Reddy Auth vs WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce