oaron

OneCode Login provides a modern, passwordless authentication experience for your WordPress site. Instead of traditional passwords, users receive a secure 6-digit verification code via email.
<h4>Key Features</h4>
<ul>
<li>Passwordless Authentication – Users log in with just their email address</li>
<li>6-Digit Verification Codes – Secure, time-limited codes sent via email</li>
<li>Rate Limiting – Built-in protection against brute force attacks</li>
<li>Request ID Binding – Each code is bound to a specific login session for enhanced security</li>
<li>Neutral Feedback – Prevents user enumeration attacks by not revealing if an email exists</li>
<li>Customizable – Configure expiry times, cooldowns, and email templates</li>
<li>Accessible – Full keyboard navigation and screen reader support</li>
<li>Gutenberg Block – Easy to add login forms to any page</li>
<li>Shortcode Support – Use [onecode_login] anywhere</li>
<li>wp-login.php Integration – Optionally replace the default WordPress login</li>
<li>Developer API – Other plugins can use OneCode Login as an email one-time-code (OTP) service to verify a visitor’s email — see the Developer information section</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Cryptographically secure code generation</li>
<li>Codes and magic-link tokens are stored HMAC-hashed, never in plain text</li>
<li>Configurable code expiry (default: 10 minutes)</li>
<li>Resend cooldown to prevent spam</li>
<li>IP-based and email-based rate limiting</li>
<li>Automatic lockout after failed attempts</li>
<li>Codes are single-use and invalidated after successful login</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>Membership sites where password fatigue is an issue</li>
<li>Customer portals requiring simple authentication</li>
<li>Internal tools where security without complexity is needed</li>
<li>Any site wanting to improve user experience</li>
</ul>
<h3>Developer information</h3>
Other plugins on the same site can use OneCode Login as a generic email 
one-time-code (OTP) service — for example to verify a guest’s email before 
letting them act. OneCode emails the code and verifies it; your plugin keeps 
full control of its own login/session (OneCode only asserts that the code is 
valid for the email — it never logs anyone in). It works for any email 
address; the address does not need a WordPress account.
All entry points are plain functions (and matching filters), so you do not need 
a hard dependency on any class. The API is gated by the Settings → Advanced → 
Enable developer API toggle.
Detect support (side-effect free — never call the request hook just to probe):
<pre><code>if ( function_exists( 'onecode_login_request_otp' ) && onecode_login_supports( 'otp' ) ) { ... }
</code></pre>
<ol>
<li>
Start authentication — email a code and receive a handle:
$handle = onecode_login_request_otp( $email, array( ‘consumer’ => ‘my_plugin’ ) ); 
// $handle = array( ‘request_id’, ‘auth_secret’, ‘expires_in’ (seconds), ‘expires_at’ (UTC), ‘sent’ ) 
// On failure: a WP_Error (codes: disabled, invalid_request, rate_limited, cooldown).
</li>
</ol>
Keep <code>request_id</code> and <code>auth_secret</code> server-side (e.g. in a transient tied to the 
visitor). The <code>auth_secret</code> is NEVER shown to the customer — it is what stops an 
outsider who only knows the email from completing verification by guessing codes.
<ol>
<li>
Complete authentication — the customer gives your plugin the code from the email:
$result = onecode_login_verify_otp( array( 
 ’email’ => $email, 
 ‘request_id’ => $handle[‘request_id’], 
 ‘code’ => $code_from_customer, 
 ‘auth_secret’ => $handle[‘auth_secret’], 
 ‘consumer’ => ‘my_plugin’, 
) ); 
// Success: array( ‘valid’ => true, ’email’ => … ). Failure: WP_Error.
</li>
</ol>
On failure show a generic message to the user (the API intentionally returns a 
single <code>verify_failed</code> code so it can’t be used as an oracle).
Filters are also available for loose coupling: <code>onecode_login_request_otp</code> 
(<code>$pre, $email, $args</code>) and <code>onecode_login_verify_otp</code> (<code>$pre, $args</code>).
Discovery and capabilities:
<ul>
<li><code>onecode_login_supports( $feature )</code> — returns true for <code>'otp'</code>, 
 ‘identity_assertion’ and <code>'any_email'</code>.</li>
<li><code>onecode_login_api()</code> — returns the <code>OneCode_Login_API</code> service instance.</li>
<li><code>OneCode_Login_API::VERSION</code> — the API contract version (independent of the 
plugin version), so you can feature-gate against the API surface.</li>
<li><code>do_action( 'onecode_login_api_init', $api )</code> — fires once the API is ready; 
bind to it if you want to wire up as soon as OneCode Login loads.</li>
</ul>
Reference: <code>$args['consumer']</code> (a short <code>[a-z0-9_-]</code> label identifying your 
integration) is required on both calls — it isolates your codes and rate limits 
from the built-in login and from other consumers. Both request and verify are 
rate-limited by OneCode, returning <code>rate_limited</code> / <code>cooldown</code> WP_Errors you can 
surface to the user.

OneCode Login

Simple and secure passwordless login using email verification codes. No passwords to remember, just enter your email and verify with a 6-digit code.

Freemius

NUMAN RASHEED

GateLink Manager pairs with the companion GateLink Client to deliver secure, zero‑config single sign‑on for WordPress. Skip copying credentials across sites: connect your hub to client sites and teleport into their dashboards with a single click. Whether you’re a developer, freelancer or agency managing many installations, GateLink saves time and reduces risk by using cryptographically signed links that expire within minutes.
<h3>Key Features</h3>
<ul>
<li>Zero‑config, one‑click login – Jump straight into any connected site’s wp‑admin without passwords. </li>
<li>Passwordless SSO & HMAC security – Each login URL is HMAC‑signed and valid for only a short time. </li>
<li>Multi‑site management – Add, edit, delete, verify and log in to client sites from a single dashboard. </li>
<li>Free plan included – Manage up to 3 sites at no cost; upgrade to Pro (20 sites) or Business (unlimited) when needed. </li>
<li>Built‑in logs & metrics – View connection history and lightweight stats right from the dashboard. </li>
<li>Modern UI – Responsive admin interface styled with Tailwind, tuned for accessibility and ease of use. </li>
</ul>
<h3>How It Works</h3>
<ol>
<li>Add a site – Enter the client’s base URL on your Manager dashboard. </li>
<li>Share a token – Create or paste the Shared Token in Manager; paste the same token in the Client’s “Trusted Manager” screen. </li>
<li>Verify & trust – Click Verify to perform a health check and establish trust. </li>
<li>Login – Click Login; a short‑lived, HMAC‑signed URL opens the client site in a new tab, validates the signature and redirects to <code>/wp-admin</code>. </li>
</ol>
<h3>Security & Privacy</h3>
<ul>
<li>Cryptographically signed tokens – All login links use HMAC‑SHA256 signatures with nonce‑based replay protection. </li>
<li>Time‑limited links – Tokens expire after a few minutes to reduce attack windows. </li>
<li>No stored credentials – GateLink never stores your admin passwords; only minimal metadata and logs are kept locally. </li>
<li>HTTPS required – Both Manager and Client sites must run over HTTPS; allow‑list the login query parameters (<code>gatelink_login</code>, <code>cid</code>, <code>ts</code>, <code>sig</code>) in security/CDN tools if necessary. </li>
</ul>
<h3>Plans & Licensing</h3>
GateLink is free to use for up to three client sites. Professional and Business plans unlock higher site limits and additional support options. Licensing is handled through Freemius; no license key is required for the free tier.
<h3>External Services</h3>
GateLink communicates only with other WordPress sites that have the GateLink Client plugin installed. Data exchanged includes site URLs, shared tokens, and connection timestamps. Licensing and support are provided via the Freemius service; activating a paid license sends your site domain, license key, and environment info to Freemius for validation.

GateLink Manager – Secure One‑Click Admin Login & WordPress SSO

Secure, passwordless admin access for multiple WordPress sites—one‑click, HMAC‑signed SSO for remote wp‑admin login.

OneCode Login vs GateLink Manager – Secure One‑Click Admin Login & WordPress SSO