oaron

OneCode Login provides a modern, passwordless authentication experience for your WordPress site. Instead of traditional passwords, users receive a secure 6-digit verification code via email.
<h4>Key Features</h4>
<ul>
<li>Passwordless Authentication – Users log in with just their email address</li>
<li>6-Digit Verification Codes – Secure, time-limited codes sent via email</li>
<li>Rate Limiting – Built-in protection against brute force attacks</li>
<li>Request ID Binding – Each code is bound to a specific login session for enhanced security</li>
<li>Neutral Feedback – Prevents user enumeration attacks by not revealing if an email exists</li>
<li>Customizable – Configure expiry times, cooldowns, and email templates</li>
<li>Accessible – Full keyboard navigation and screen reader support</li>
<li>Gutenberg Block – Easy to add login forms to any page</li>
<li>Shortcode Support – Use [onecode_login] anywhere</li>
<li>wp-login.php Integration – Optionally replace the default WordPress login</li>
<li>Developer API – Other plugins can use OneCode Login as an email one-time-code (OTP) service to verify a visitor’s email — see the Developer information section</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Cryptographically secure code generation</li>
<li>Codes and magic-link tokens are stored HMAC-hashed, never in plain text</li>
<li>Configurable code expiry (default: 10 minutes)</li>
<li>Resend cooldown to prevent spam</li>
<li>IP-based and email-based rate limiting</li>
<li>Automatic lockout after failed attempts</li>
<li>Codes are single-use and invalidated after successful login</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>Membership sites where password fatigue is an issue</li>
<li>Customer portals requiring simple authentication</li>
<li>Internal tools where security without complexity is needed</li>
<li>Any site wanting to improve user experience</li>
</ul>
<h3>Developer information</h3>
Other plugins on the same site can use OneCode Login as a generic email 
one-time-code (OTP) service — for example to verify a guest’s email before 
letting them act. OneCode emails the code and verifies it; your plugin keeps 
full control of its own login/session (OneCode only asserts that the code is 
valid for the email — it never logs anyone in). It works for any email 
address; the address does not need a WordPress account.
All entry points are plain functions (and matching filters), so you do not need 
a hard dependency on any class. The API is gated by the Settings → Advanced → 
Enable developer API toggle.
Detect support (side-effect free — never call the request hook just to probe):
<pre><code>if ( function_exists( 'onecode_login_request_otp' ) && onecode_login_supports( 'otp' ) ) { ... }
</code></pre>
<ol>
<li>
Start authentication — email a code and receive a handle:
$handle = onecode_login_request_otp( $email, array( ‘consumer’ => ‘my_plugin’ ) ); 
// $handle = array( ‘request_id’, ‘auth_secret’, ‘expires_in’ (seconds), ‘expires_at’ (UTC), ‘sent’ ) 
// On failure: a WP_Error (codes: disabled, invalid_request, rate_limited, cooldown).
</li>
</ol>
Keep <code>request_id</code> and <code>auth_secret</code> server-side (e.g. in a transient tied to the 
visitor). The <code>auth_secret</code> is NEVER shown to the customer — it is what stops an 
outsider who only knows the email from completing verification by guessing codes.
<ol>
<li>
Complete authentication — the customer gives your plugin the code from the email:
$result = onecode_login_verify_otp( array( 
 ’email’ => $email, 
 ‘request_id’ => $handle[‘request_id’], 
 ‘code’ => $code_from_customer, 
 ‘auth_secret’ => $handle[‘auth_secret’], 
 ‘consumer’ => ‘my_plugin’, 
) ); 
// Success: array( ‘valid’ => true, ’email’ => … ). Failure: WP_Error.
</li>
</ol>
On failure show a generic message to the user (the API intentionally returns a 
single <code>verify_failed</code> code so it can’t be used as an oracle).
Filters are also available for loose coupling: <code>onecode_login_request_otp</code> 
(<code>$pre, $email, $args</code>) and <code>onecode_login_verify_otp</code> (<code>$pre, $args</code>).
Discovery and capabilities:
<ul>
<li><code>onecode_login_supports( $feature )</code> — returns true for <code>'otp'</code>, 
 ‘identity_assertion’ and <code>'any_email'</code>.</li>
<li><code>onecode_login_api()</code> — returns the <code>OneCode_Login_API</code> service instance.</li>
<li><code>OneCode_Login_API::VERSION</code> — the API contract version (independent of the 
plugin version), so you can feature-gate against the API surface.</li>
<li><code>do_action( 'onecode_login_api_init', $api )</code> — fires once the API is ready; 
bind to it if you want to wire up as soon as OneCode Login loads.</li>
</ul>
Reference: <code>$args['consumer']</code> (a short <code>[a-z0-9_-]</code> label identifying your 
integration) is required on both calls — it isolates your codes and rate limits 
from the built-in login and from other consumers. Both request and verify are 
rate-limited by OneCode, returning <code>rate_limited</code> / <code>cooldown</code> WP_Errors you can 
surface to the user.

OneCode Login

Simple and secure passwordless login using email verification codes. No passwords to remember, just enter your email and verify with a 6-digit code.

Katsushi Kawamori

Enter your email address, and send you an email with a magic link or QR Code to login without a password.
<h4>Login</h4>
<ul>
<li>Login with email address only.</li>
<li>Only registered users can login.</li>
<li>Password-less login from the magic link or QR code notified in the email.</li>
<li>shortcode : <code>[magic_login]</code></li>
<li>action hook : <code>do_action( 'magic_email_send', $emails | array, true | bool )</code> : To send the magic link simultaneously from the management account.</li>
<li>QR code login on the user’s administration screen.</li>
</ul>
<h4>Thanks</h4>
<ul>
<li>This plugin is a modified version of <a href="https://wordpress.org/plugins/passwordless-login/" rel="ugc">Passwordless Login</a>.</li>
<li>The main changes are the addition of various filter hooks and the addition of the following action hooks.</li>
</ul>
<h4>Action hook</h4>
<ul>
<li>This is for sending bulk e-mails with a magic link for login to multiple accounts from the management screen.</li>
<li>When using this action hook, the URL of the page where the shortcode [magic_login] is placed should be specified in the filter hook ‘magic_login_mail_url’.</li>
</ul>
<pre><code>/** ==================================================
 * To send the magic link simultaneously from the management account.
 *
 * @param array $emails Multiple email addresses.
 * @param bool true Output notifications to the management screen immediately after sending.
 */
do_action( 'magic_email_send', $emails, true );
</code></pre>
<h4>Filter hooks</h4>
<pre><code>/** ==================================================
 * Filter for magic link url with mail.
 *
 */
add_filter( 'magic_login_mail_url', function(){ return 'url'; }, 10, 1 );
</code></pre>
<pre><code>/** ==================================================
 * Currently logged in user link for Magic Login Mail
 *
 * @param string $url URL.
 * @param int $user_id User ID.
 * @return $url
 */
add_filter( 'magic_login_mail_user_redirect', 'redirect_url_login_users', 10, 2 );

/** ==================================================
 * Login user after redirect for Magic Login Mail
 *
 * @param string $url URL.
 * @param int $user_id User ID.
 * @return $url
 */
add_filter( 'magic_login_mail_after_login_redirect', 'redirect_url_login_users', 10, 2 );

function redirect_url_login_users( $url, $user_id ){
 /* your code */
 return $url;
}
</code></pre>
<pre><code>/** ==================================================
 * Filter for message with shortcode form.
 *
 */
add_filter( 'magic_login_mail_success_link_msg', function(){ return 'Message for success.'; }, 10, 1 );
add_filter( 'magic_login_mail_success_login_msg', function(){ return 'Message for success with login.'; }, 10, 1 );
add_filter( 'magic_login_mail_valid_errors', function(){ return 'Message for mail validation error.'; }, 10, 1 );
add_filter( 'magic_login_mail_email_errors', function(){ return 'Message for sent mail error.'; }, 10, 1 );
add_filter( 'magic_login_mail_invalid_token_error', function(){ return 'Message for token error.'; }, 10, 1 );
add_filter( 'magic_login_mail_form_label', function(){ return 'Message for form label.'; }, 10, 1 );
</code></pre>
<pre><code>/** ==================================================
 * Filter for color with shortcode form.
 *
 */
add_filter( 'magic_login_mail_success_link_msg_back_color', function(){ return '#e7f7d3'; }, 10, 1 );
add_filter( 'magic_login_mail_success_login_msg_back_color', function(){ return '#e7f7d3'; }, 10, 1 );
add_filter( 'magic_login_mail_valid_errors_back_color', function(){ return '#ffebe8'; }, 10, 1 );
add_filter( 'magic_login_mail_email_errors_back_color', function(){ return '#ffebe8'; }, 10, 1 );
add_filter( 'magic_login_mail_invalid_token_error_back_color', function(){ return '#ffebe8'; }, 10, 1 );
</code></pre>
<pre><code>/** ==================================================
 * Filter for input text size.
 *
 */
add_filter( 'magic_login_mail_input_size', function(){ return 17; }, 10, 1 );
</code></pre>
<pre><code>/** ==================================================
 * Filter for class name.
 *
 */
add_filter( 'magic_login_mail_notice_class_name', function(){ return 'mynotice'; }, 10, 1 );
add_filter( 'magic_login_mail_form_class_name', function(){ return 'myform'; }, 10, 1 );
add_filter( 'magic_login_mail_label_class_name', function(){ return 'mylabel'; }, 10, 1 );
add_filter( 'magic_login_mail_input_class_name', function(){ return 'myinput'; }, 10, 1 );
add_filter( 'magic_login_mail_submit_class_name', function(){ return 'mysubmit'; }, 10, 1 );
</code></pre>
<pre><code>/** ==================================================
 * Filter for message with mail subject.
 *
 */
add_filter( 'magic_login_mail_subject', function(){ return 'subject'; }, 10, 1 );
</code></pre>
<pre><code>/** ==================================================
 * Filter for message with mail.
 *
 * @param string $message message.
 * @param string $url url.
 * @param string $exp_date_time expiration date and time.
 */
add_filter(
 'magic_login_mail_message',
 function( $message, $url, $exp_date_time ) {

 $message .= ' ' . 'You may only log in once using the link above.';

 return $message;
 },
 10,
 3
);
</code></pre>
<pre><code>/** ==================================================
 * Filter for login expiration.
 *
 */
add_filter( 'magic_login_mail_expiration', function(){ return 10; }, 10, 1 );
</code></pre>

Magic Login Mail or QR Code

Enter your email address, and send you an email with a magic link or QR Code to login without a password.

OneCode Login vs Magic Login Mail or QR Code