MksDdn Reddy Auth provides OTP-based authentication with:
<ul>
<li>WordPress cookie session login for the frontend (shortcode, or REST with <code>issue_session: true</code>).</li>
<li>Optional Bearer token issuing for REST clients (<code>issue_token: true</code>; cookie not set by default on REST login).</li>
<li>Rate limiting and one-time OTP verification.</li>
<li>Optional site and REST API protection for unauthenticated visitors.</li>
<li>Optional allowed request sources (Origin/Referer) for plugin REST endpoints.</li>
</ul>
The plugin maps each Reddy ID to a WordPress user and can create an account automatically on first successful login.
<h3>Getting Started</h3>
<h4>1. Configure the Reddy bot token</h4>
For production, define the token in <code>wp-config.php</code>:
<pre><code>define( 'MKSDDN_REDDY_BOT_TOKEN', 'your-bot-token' );
</code></pre>
For local development you can store the token in Settings > Reddy Auth instead. Use Bot connection test to verify delivery to a Reddy user.
<h4>2. Set up the login page</h4>
Create a WordPress page (for example, <code>/login/</code>) and insert:
<pre><code>[mksddn_reddy_login]
</code></pre>
Users enter their Reddy ID, receive a one-time code in Reddy, and sign in through the form.
<h4>3. Review protection settings</h4>
By default, both protection options are disabled so your site stays accessible after activation. Enable them only after the login page is configured:
<ul>
<li>Protect site content — redirects unauthenticated visitors to the login page.</li>
<li>Protect all REST API content — returns <code>401</code> for protected REST routes.</li>
</ul>
Public auth routes remain available without login:
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/send-code</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/login</code></li>
<li><code>GET /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/intent-status</code></li>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/complete-intent</code></li>
</ul>
Webhook callback route is also public for BotMother integration:
<ul>
<li><code>POST /wp-json/mksddn-reddy-auth/v1/auth/button-callback</code></li>
</ul>
<h4>4. Use REST API for headless clients</h4>
Typical flow:
<ol>
<li><code>POST /auth/send-code</code> with <code>{ "reddy_id": "123456" }</code></li>
<li><code>POST /auth/login</code> with <code>{ "reddy_id": "123456", "code": "111111", "issue_token": true }</code> for headless clients. Add <code>"issue_session": true</code> only when the browser must also receive a WordPress cookie (same-origin SPA).</li>
<li>Call protected REST routes with <code>Authorization: Bearer <token></code>.</li>
<li><code>GET /auth/me</code> to read the current user (Bearer or cookie session).</li>
<li><code>POST /auth/logout</code> to end the cookie session and revoke the Bearer token when provided.</li>
</ol>
One-click flow:
<ol>
<li><code>POST /auth/send-code</code> returns <code>intent_id</code> and <code>intent_secret</code> when one-click is enabled.</li>
<li>Poll <code>GET|POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code>.</li>
<li>After approval, finalize auth via <code>POST /auth/complete-intent</code> with <code>intent_id</code>, <code>intent_secret</code>, and optional <code>issue_token</code> / <code>issue_session</code>.</li>
</ol>
For one-click polling, <code>intent-status</code> supports both:
<ul>
<li><code>GET /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> query params.</li>
<li><code>POST /auth/intent-status</code> with <code>intent_id</code> + <code>intent_secret</code> in JSON body.</li>
</ul>
Protect site content checks the WordPress cookie session (shortcode login or REST login with <code>issue_session: true</code>). It does not accept Bearer tokens. Protect all REST API content requires a Bearer token and ignores cookie-only sessions.
Download OpenAPI and Postman files from Settings > Reddy Auth > Developer Resources.
<h4>5. Optional: restrict REST callers by browser source</h4>
In Settings > Reddy Auth, Allowed request sources limits plugin REST traffic (<code>/mksddn-reddy-auth/v1/*</code>) to listed <code>Origin</code> or <code>Referer</code> URLs. Leave empty to allow any client (recommended for server-to-server integrations). This is a soft guard for browser apps, not a secret key.
<h4>6. Optional: harden one-click webhook verification</h4>
In Settings > Reddy Auth > One-Click Authorization, set Webhook secret (optional) to match BotMother webhook Secret.
<ul>
<li>With a configured secret, webhook signature verification uses <code>sha256(body + bot_token + "." + webhook_secret)</code>.</li>
<li>With an empty secret, compatibility mode uses <code>sha256(body + bot_token)</code>.</li>
</ul>
<h3>External services</h3>
This plugin connects to the Reddy bot API at <code>https://bot.reddy.team</code> to deliver one-time passwords and optional admin connection test messages.
What the service is used for
<ul>
<li>Deliver OTP codes to a Reddy user during login.</li>
<li>Send an optional admin “bot connection test” message from Settings > Reddy Auth.</li>
</ul>
What data is sent and when
<ul>
<li>OTP send / login: Reddy user ID (<code>userKey</code>) and message text containing the one-time code (and expiry hint). Message text is configurable in Settings > Reddy Auth > Bot Messages (placeholders <code>{code}</code>, <code>{ttl}</code>). Sent when a user requests a code via the login form or REST API.</li>
<li>Bot connection test: Reddy user ID (<code>userKey</code>) and a configurable test message from Settings > Reddy Auth > Bot Messages. Sent only when an administrator runs Bot connection test in Settings > Reddy Auth.</li>
<li>Bot token: Your bot token is included in the API request URL path (configured via <code>MKSDDN_REDDY_BOT_TOKEN</code> in <code>wp-config.php</code> or the development fallback field in settings). It is not sent to WordPress.org.</li>
</ul>
Data is transmitted only when OTP delivery or the connection test is triggered. The plugin does not send site content, post data, or WordPress user passwords to Reddy.
This service is provided by Reddy: terms of use and privacy policy at https://help.reddy.team/pages/user-agreement
No other third-party services are required for core plugin operation.

MksDdn Reddy Auth

Authenticate WordPress users via Reddy OTP flow for monolith and REST API clients.

mohsin.id

spartac

<a href="https://www.wpsms.io/" rel="nofollow ugc">NotifSMS For WordPress</a> enables you to send text messages, OTP codes, and 2FA notifications directly from your WordPress site. 
You can send SMS alerts via Twilio, custom SMS gateways, or other supported providers.
Whether you want to notify WooCommerce customers,send OTP for login, or broadcast SMS to users, this plugin provides a straightforward solution.
<h3>🔹 Features</h3>
<ul>
<li>Send SMS from WordPress – Quickly send single or bulk SMS from your WordPress dashboard. </li>
<li>WooCommerce SMS Alerts – Notify customers about order status updates (completed, shipped, cancelled, etc.). </li>
<li>Contact Form 7 & Gravity Forms Integration – Send SMS when a form is submitted. </li>
<li>OTP & 2FA (Two Factor Authentication) – Add secure SMS-based login or verification. </li>
<li>Custom SMS Gateways – Use Twilio or integrate your preferred provider. </li>
<li>Bulk & Newsletter SMS – Send bulk SMS to all users or by user role. </li>
<li>Admin SMS Notifications – Get notified instantly of site activities (new user, post, comment, etc.). </li>
<li>URL Shortening Support – Integrates Bit.ly or Google URL Shortener API. </li>
<li>Developer Friendly – Hooks and filters for custom integrations. </li>
<li>Easy setup – Activate, configure your API key, and start sending SMS in minutes!</li>
</ul>
<h3>🔹 Use Cases</h3>
This plugin is optimized for speed, flexibility, and reliability. It integrates seamlessly with popular plugins and is ideal for: 
– WooCommerce stores that want to send SMS order notifications 
– WordPress membership or e-learning sites that need 2FA/OTP SMS 
– Businesses wanting SMS marketing or user alerts
You can even extend it with premium addons for deeper integrations.
<h3>🔸 Premium Addons</h3>
Upgrade with Pro Addons to unlock more SMS automation and integrations:
<ul>
<li>WooCommerce SMS Addon – Automatic order SMS notifications. </li>
<li>Event Espresso SMS Reminder – Send reminders to event attendees. </li>
<li>Bulk SMS Addon – Send SMS to all users, by role, or to custom lists. </li>
<li>Contact Form 7 SMS Addon – Admin SMS notifications for new form submissions. </li>
<li>Easy Digital Downloads Addon – Customer SMS notifications on order updates. </li>
<li>ClassiPress / Vantage / AdForest Addons – Send SMS to ad owners and business listers. </li>
</ul>
<a href="https://wpsms.io/sms-plugins/" rel="nofollow ugc">View all addons →</a>
Need a custom integration? <a href="https://wpsms.io/" rel="nofollow ugc">Contact us</a> — we’ll help you build one.
Visit <a href="https://www.wpsms.io/" rel="nofollow ugc">WPSMS.io</a> for documentation, guides, and API details. 
Contributors are welcome via <a href="https://github.com/mohsinoffline/wp-twilio-core" rel="nofollow ugc">GitHub</a>.
<blockquote>
Disclaimer: This plugin is not affiliated with or endorsed by Twilio, Inc., WordPress, WooCommerce, or any other third-party service mentioned. All trademarks belong to their respective owners.
</blockquote>
<h3>Third-Party Services</h3>
This plugin may send data to the following third-party services when certain features are enabled:
<h3>Bitly URL Shortener</h3>
When used: When the “Shorten URLs using Bit.ly” option is enabled in plugin settings, URLs in SMS messages are automatically shortened using the Bitly API.
Service Information: 
* Service Website: https://bitly.com/ 
* API Documentation: https://dev.bitly.com/v4_documentation.html 
* Terms of Service: https://bitly.com/pages/tos 
* Privacy Policy: https://bitly.com/pages/privacy
Data Sent: Long URLs from SMS messages are sent to Bitly’s API to generate shortened URLs. No personal user data is sent beyond the URLs themselves.
<h3>Google URL Shortener (Deprecated)</h3>
When used: When the “Shorten URLs using Google (Deprecated)” option is enabled in plugin settings, URLs in SMS messages are automatically shortened using the Google URL Shortener API.
Note: Google has deprecated this service. We recommend using Bitly instead.
Service Information: 
* Service Website: https://developers.google.com/url-shortener 
* Terms of Service: https://developers.google.com/terms 
* Privacy Policy: https://policies.google.com/privacy
Data Sent: Long URLs from SMS messages are sent to Google’s API to generate shortened URLs. No personal user data is sent beyond the URLs themselves.
Important: These third-party services are only used when you explicitly enable URL shortening in the plugin settings. If URL shortening is disabled, no data is sent to these services.

NotifSMS – SMS Notifications OTP & 2FA for WordPress & WooCommerce

This plugin works like a charm. Thanks to the author!



Excellent Work

Send SMS, OTP & 2FA notifications from WordPress via Twilio. Includes automated alerts, bulk messaging, and integrations with popular plugins.

MksDdn Reddy Auth vs NotifSMS – SMS Notifications OTP & 2FA for WordPress & WooCommerce