oaron

OneCode Login provides a modern, passwordless authentication experience for your WordPress site. Instead of traditional passwords, users receive a secure 6-digit verification code via email.
<h4>Key Features</h4>
<ul>
<li>Passwordless Authentication – Users log in with just their email address</li>
<li>6-Digit Verification Codes – Secure, time-limited codes sent via email</li>
<li>Rate Limiting – Built-in protection against brute force attacks</li>
<li>Request ID Binding – Each code is bound to a specific login session for enhanced security</li>
<li>Neutral Feedback – Prevents user enumeration attacks by not revealing if an email exists</li>
<li>Customizable – Configure expiry times, cooldowns, and email templates</li>
<li>Accessible – Full keyboard navigation and screen reader support</li>
<li>Gutenberg Block – Easy to add login forms to any page</li>
<li>Shortcode Support – Use [onecode_login] anywhere</li>
<li>wp-login.php Integration – Optionally replace the default WordPress login</li>
<li>Developer API – Other plugins can use OneCode Login as an email one-time-code (OTP) service to verify a visitor’s email — see the Developer information section</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Cryptographically secure code generation</li>
<li>Codes and magic-link tokens are stored HMAC-hashed, never in plain text</li>
<li>Configurable code expiry (default: 10 minutes)</li>
<li>Resend cooldown to prevent spam</li>
<li>IP-based and email-based rate limiting</li>
<li>Automatic lockout after failed attempts</li>
<li>Codes are single-use and invalidated after successful login</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>Membership sites where password fatigue is an issue</li>
<li>Customer portals requiring simple authentication</li>
<li>Internal tools where security without complexity is needed</li>
<li>Any site wanting to improve user experience</li>
</ul>
<h3>Developer information</h3>
Other plugins on the same site can use OneCode Login as a generic email 
one-time-code (OTP) service — for example to verify a guest’s email before 
letting them act. OneCode emails the code and verifies it; your plugin keeps 
full control of its own login/session (OneCode only asserts that the code is 
valid for the email — it never logs anyone in). It works for any email 
address; the address does not need a WordPress account.
All entry points are plain functions (and matching filters), so you do not need 
a hard dependency on any class. The API is gated by the Settings → Advanced → 
Enable developer API toggle.
Detect support (side-effect free — never call the request hook just to probe):
<pre><code>if ( function_exists( 'onecode_login_request_otp' ) && onecode_login_supports( 'otp' ) ) { ... }
</code></pre>
<ol>
<li>
Start authentication — email a code and receive a handle:
$handle = onecode_login_request_otp( $email, array( ‘consumer’ => ‘my_plugin’ ) ); 
// $handle = array( ‘request_id’, ‘auth_secret’, ‘expires_in’ (seconds), ‘expires_at’ (UTC), ‘sent’ ) 
// On failure: a WP_Error (codes: disabled, invalid_request, rate_limited, cooldown).
</li>
</ol>
Keep <code>request_id</code> and <code>auth_secret</code> server-side (e.g. in a transient tied to the 
visitor). The <code>auth_secret</code> is NEVER shown to the customer — it is what stops an 
outsider who only knows the email from completing verification by guessing codes.
<ol>
<li>
Complete authentication — the customer gives your plugin the code from the email:
$result = onecode_login_verify_otp( array( 
 ’email’ => $email, 
 ‘request_id’ => $handle[‘request_id’], 
 ‘code’ => $code_from_customer, 
 ‘auth_secret’ => $handle[‘auth_secret’], 
 ‘consumer’ => ‘my_plugin’, 
) ); 
// Success: array( ‘valid’ => true, ’email’ => … ). Failure: WP_Error.
</li>
</ol>
On failure show a generic message to the user (the API intentionally returns a 
single <code>verify_failed</code> code so it can’t be used as an oracle).
Filters are also available for loose coupling: <code>onecode_login_request_otp</code> 
(<code>$pre, $email, $args</code>) and <code>onecode_login_verify_otp</code> (<code>$pre, $args</code>).
Discovery and capabilities:
<ul>
<li><code>onecode_login_supports( $feature )</code> — returns true for <code>'otp'</code>, 
 ‘identity_assertion’ and <code>'any_email'</code>.</li>
<li><code>onecode_login_api()</code> — returns the <code>OneCode_Login_API</code> service instance.</li>
<li><code>OneCode_Login_API::VERSION</code> — the API contract version (independent of the 
plugin version), so you can feature-gate against the API surface.</li>
<li><code>do_action( 'onecode_login_api_init', $api )</code> — fires once the API is ready; 
bind to it if you want to wire up as soon as OneCode Login loads.</li>
</ul>
Reference: <code>$args['consumer']</code> (a short <code>[a-z0-9_-]</code> label identifying your 
integration) is required on both calls — it isolates your codes and rate limits 
from the built-in login and from other consumers. Both request and verify are 
rate-limited by OneCode, returning <code>rate_limited</code> / <code>cooldown</code> WP_Errors you can 
surface to the user.

OneCode Login

Simple and secure passwordless login using email verification codes. No passwords to remember, just enter your email and verify with a 6-digit code.

Kombiah Ramaiah

Suresh Kumar R

Muthu Pandi

Happy Coders

Gopi C

Happy Coders OTP Login is a simple, secure, and customizable OTP login plugin for WordPress and WooCommerce sites. It enables users to log in using their mobile number via one-time password (OTP) verification, using the MSG91 SMS API, and also supports email-based OTP login.
The plugin supports full-screen and popup login forms, integrates smoothly with WooCommerce, and improves user experience by replacing traditional email/password logins with secure phone-based authentication.
Now, you can fully customize your transactional SMS messages using dynamic variables like <code>##customer_name##</code>, <code>##order_id##</code>, and more, directly from the plugin settings.
Watch our <a href="https://www.youtube.com/watch?v=JTToziAf5gM" rel="nofollow ugc">quick video tutorial</a> to see how easy it is to set up!
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/JTToziAf5gM?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h3>MSG91 Integration</h3>
This plugin uses the MSG91 SMS and WhatsApp gateway (https://msg91.com) to send and verify OTPs, and also to send order-related notifications. You must have a valid MSG91 account and approved SMS/WhatsApp templates. You can <a href="https://msg91.com/signup?utm_source=happycoders" rel="nofollow ugc">sign up here</a>
Visit <a href="https://msg91.com/legal/terms" rel="nofollow ugc">MSG91’s Terms of Service</a> and <a href="https://msg91.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a> for more details about how they handle data
<h3>Data Handling and Privacy</h3>
<ul>
<li>Only the phone number is sent to MSG91 for OTP and transactional SMS/WhatsApp delivery.</li>
<li>No personal or sensitive user data is stored or tracked by this plugin.</li>
<li>Plugin does not collect analytics or track users without consent.</li>
<li>All configurable from the plugin settings page.</li>
</ul>
🔥 Features: 
– Full-screen or popup OTP login form 
– WooCommerce login compatibility 
– OTP verification via MSG91 (SMS & WhatsApp) 
– Email OTP login option 
– WhatsApp Send OTP support 
– Automatic SMS/WhatsApp alerts for: 
 – New user registration 
 – Order placed 
 – Order shipped 
 – Order completed 
 – Cart cronjob (abandoned cart reminders) 
– Customizable resend timer 
– Country code and flag selection 
– Shortcodes for embedding login anywhere 
– Admin panel for MSG91 and plugin settings 
– Customizable transactional SMS templates with dynamic variables (e.g., <code>##customer_name##</code>, <code>##order_id##</code>). 
– Dynamic OTP length (4 or 6 digits).
🎯 Shortcodes: 
– <code>[msg91_otp_form]</code> – Display full-screen OTP login form anywhere (pages, posts, widgets).
🔧 Admin Settings: 
– MSG91 Auth Key, Sender ID, Template IDs 
– Enable/disable WhatsApp OTP option 
– Country code options 
– OTP resend timer settings 
– Button/text color customization 
– Post-login redirect URL 
– OTP send limit per user/day 
– Enable/disable specific SMS/WhatsApp features (registration, order, cart) 
– Customizable SMS message templates with dynamic variables.
<h3>Configuration</h3>
<ol>
<li>Get an MSG91 Account: This plugin requires an MSG91 account. If you don’t have one, you can <a href="https://msg91.com/signup?utm_source=happycoders" rel="nofollow ugc">sign up here</a>.</li>
<li>Enter Credentials: In the plugin settings, enter your MSG91 Auth Key, Sender ID, and DLT-approved Template IDs.</li>
<li>Display the Form: Use the shortcode <code>[msg91_otp_form]</code> on any page or add the CSS class <code>otp-popup-trigger</code> to a button/link to show the login form.</li>
</ol>
<h3>Support</h3>
We are committed to helping you succeed. To get you the fastest and most accurate help, please direct your query to the correct team.
<h3>For Plugin Issues & Configuration (Happy Coders Support)</h3>
If you need help with installing the plugin, configuring its settings in WordPress, encounter a bug, or have a feature request for the plugin itself, please use our official support channel. 
Primary Support Channel: <a href="https://wordpress.org/support/plugin/happy-coders-otp-login/" rel="ugc">WordPress.org Support Forum</a>
<h3>For MSG91 Service & Delivery Issues (MSG91 Support)</h3>
If your question is about the MSG91 service itself—such as your account, API key, billing, Sender ID approval, DLT templates, or SMS/WhatsApp delivery reports—you must contact the MSG91 support team directly. They are the experts on their platform and can assist you with all service-related inquiries. 
Contact MSG91 Support: <a href="https://msg91.com/in/contact-us" rel="nofollow ugc">Visit the MSG91 Contact Page</a>

Happy Coders OTP Login for WooCommerce

Secure OTP login for WordPress & WooCommerce using SMS, WhatsApp, and Email. Send automated order alerts with the MSG91 API. Be passwordless!

OneCode Login vs Happy Coders OTP Login for WooCommerce