QRAuth

QRAuth replaces the password field on your WordPress login page with a drop-in QR widget. Users sign in by scanning with the QRAuth mobile app; a cryptographic signature is verified server-to-server before WordPress sets the auth cookie. Social login (Google, GitHub, Microsoft, Apple) is brokered by QRAuth’s hosted approval page, so you never have to register an OAuth app or hold a client secret.
One Client ID is the only configuration. Paste it into Settings → QRAuth and the widget appears on wp-login.php. Everything else — the approval flow, the signing, the token refresh — lives in the QRAuth platform.
Account safety is the default. Auto-provisioning is off out of the box: only WordPress users who already exist (matched on email) can sign in via QRAuth. Flip on auto-provisioning and new users are created as Subscriber — that’s the only role available, intentionally and at every layer (settings UI, sanitiser, runtime). Operators who need a different role for an individual user can change it manually via Users → All Users after their first sign-in. The plugin never stores the signing material, never issues a redirect outside your site, and never touches your user table on uninstall.
Self-hosted, no third-party scripts on wp-login.php. The QRAuth web component ships vendored inside the plugin — the only outbound call is from your server to QRAuth’s verification endpoint during a sign-in attempt.
Open source build. The compressed JavaScript at <code>assets/js/qrauth-components.js</code> is built from publicly available TypeScript source at https://github.com/qrauth-io/qrauth/tree/main/packages/web-components. The unminified source files are also vendored alongside the minified bundle inside this plugin (<code>assets/js/source/</code>) for offline review. See the Source section below for build instructions.
<h3>External services</h3>
This plugin connects to QRAuth (https://qrauth.io) — the identity verification service that performs the actual passwordless / social sign-in. QRAuth is operated by ProgressNet, the publisher of this plugin. Without QRAuth there is no widget and no sign-in.
What the service is and what it is used for
QRAuth verifies that the user who scanned the QR code (or completed a social-provider flow on the hosted approval page) is the same person who initiated the sign-in on your WordPress site, then returns a signed assertion that the plugin uses to set the WordPress auth cookie.
What data is sent and when
<ul>
<li>Auth-session creation — when a visitor opens a page that hosts the widget (wp-login.php, the registration form, a shortcode-enabled page, or a WooCommerce sign-in form), the plugin’s same-origin REST proxy sends your Client ID, Client Secret (server-side only — never exposed to the browser), and the host page URL to <code>https://qrauth.io/api/v1/auth-sessions</code>. No visitor data is included in this request.</li>
<li>Sign-in verification — when the visitor approves the sign-in (by scanning with the QRAuth mobile app or completing a social-provider flow on QRAuth’s hosted approval page), the plugin’s REST proxy fetches the verified result from <code>https://qrauth.io/api/v1/auth-sessions/verify-result</code>. The response carries the QRAuth user identifier and, when the <code>email</code> scope is allowed in Settings → QRAuth, the user’s email address. The plugin uses this only to locate or create the matching WordPress user; nothing beyond a hashed link reference is retained.</li>
<li>Hosted approval page — when a visitor on a phone taps “Continue with QRAuth”, the browser navigates to <code>https://qrauth.io/a/<token></code> to complete the social-provider flow. This is a standard cross-domain navigation initiated by the visitor.</li>
</ul>
The vendored web component (<code>assets/js/qrauth-components.js</code>) is served from your own WordPress site — there is no third-party JavaScript on wp-login.php, and the component does not contact qrauth.io directly from the browser; all server-to-server calls are proxied via your site’s REST API.
Service terms and policies
<ul>
<li>Terms of Service: https://qrauth.io/terms</li>
<li>Privacy Policy: https://qrauth.io/privacy</li>
<li>Data Processing Addendum: https://qrauth.io/dpa</li>
<li>List of Sub-processors: https://qrauth.io/subprocessors</li>
</ul>
<h3>Source</h3>

The compiled bundle at <code>assets/js/qrauth-components.js</code> carries the following banner header at the top of the file:
<pre><code>`
</code></pre>
/*! 
 * @qrauth/web-components v0.4.1 
 * Vendored by qrauth-passwordless-social-login. Do not edit by hand. 
 * 
 * Source: https://github.com/qrauth-io/qrauth/tree/main/packages/web-components 
 * License: MIT 
 * npm: https://www.npmjs.com/package/@qrauth/web-components 
 * Build: <code>npm install && npm run build:assets</code> (see bin/fetch-web-components.mjs) 
 * 
 * The unminified TypeScript source for this bundle is also vendored at 
 * assets/js/source/ — see assets/js/source/README.md for provenance. 
 */ 
 `
The unminified TypeScript source files are also vendored alongside the compiled bundle inside this plugin (<code>assets/js/source/</code>) for offline review.
The plugin’s own source — PHP, the small browser adapter (<code>assets/js/qrauth-adapter.js</code>), build scripts, tests, and CI — is publicly maintained under GPL-2.0-or-later at:
<ul>
<li>Plugin source repository: https://github.com/qrauth-io/qrauth-passwordless-social-login</li>
</ul>
The PHP and <code>assets/js/qrauth-adapter.js</code> shipped in the plugin ZIP are non-minified — read them directly without checking out the repo.
The vendored file <code>assets/js/qrauth-components.js</code> is a pinned production build of the public <code>@qrauth/web-components</code> library. The non-compiled source for that library is openly available:
<ul>
<li>Source repository: https://github.com/qrauth-io/qrauth/tree/main/packages/web-components (MIT-licensed)</li>
<li>npm release: https://www.npmjs.com/package/@qrauth/web-components — pinned to v0.4.1, sha512 in <code>package.json</code> under the <code>qrauth.webComponentsIntegrity</code> key</li>
<li>Build instructions for the upstream library: https://github.com/qrauth-io/qrauth/blob/main/BUILDING.md</li>
</ul>
To regenerate the vendored bundle from the pinned npm release, clone the plugin source repository linked above and run from its root:
<pre><code>npm install
npm run build:assets
</code></pre>
The build script <code>bin/fetch-web-components.mjs</code> (kept in the plugin source repository, not in the WordPress.org plugin ZIP) downloads the npm tarball, verifies its sha512 SRI hash against <code>package.json#qrauth.webComponentsIntegrity</code>, extracts the IIFE build, and writes it to <code>assets/js/qrauth-components.js</code>. CI runs the same script before the WordPress.org plugin-check job, so the bundle distributed on the directory always matches the published npm release. To rebuild from upstream source instead of the pinned tarball, follow <code>BUILDING.md</code> in the upstream library repository above.

QRAuth – Passwordless & Social Login

Passwordless sign-in for WordPress. Users scan a QR code with the QRAuth mobile app — no passwords, no forms, no OAuth apps to register.

Fahad Aslam

WP Ventra

VentraConnect provides a unified login system for WordPress: Social Login + Magic Link + Email OTP.
<ul>
<li>Social Login with 15+ providers (Google, Facebook, X/Twitter, LinkedIn, Microsoft, GitHub, and more)</li>
<li>Passwordless Login with Magic Link and Email OTP
<ul>
<li>Can run in Login only mode (existing users) or Login & Register mode (allow new accounts)</li>
</ul>
</li>
<li>Guardrails (optional): prevent spam accounts by letting Social Login, Magic Link and Email OTP log existing users in, but optionally blocking them from creating new users. This stops random visitors from turning your login screen into an open registration form, while your normal WordPress registration and any custom onboarding forms continue to work as usual.</li>
</ul>
Works out-of-the-box on the default WordPress login/registration screens (<code>wp-login.php</code>) and also supports shortcodes for custom pages and page builders.
No proxy servers. No third-party tracking. VentraConnect connects directly to each provider using official OAuth flows.
| <a href="https://wpventra.com/docs/what-is-ventraconnect-social-login/" rel="nofollow ugc">Setup</a> | <a href="https://wpventra.com/docs/" rel="nofollow ugc">Docs</a> | <a href="https://wpventra.com/pricing/" rel="nofollow ugc">Pro Addon</a> |
<h3>Modern WordPress login with VentraConnect</h3>
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/FEi8XCa6sys?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h3>Best for</h3>
<ul>
<li>Sites that want faster logins and fewer abandoned registrations by offering Social Login + passwordless login.</li>
<li>WooCommerce stores that want modern social + passwordless login on the login, checkout and My Account pages (Pro add-on).</li>
<li>Sites that are getting spam registrations and want Guardrails to control who can create new accounts from the default <code>wp-login.php</code> screen.</li>
<li>Sites that want to add passwordless login (Magic Link / Email OTP) as an option, without removing the classic username/password login.</li>
</ul>
<h3>Key Features (Free)</h3>
Social Login 
– 15+ providers (Google, Facebook, X/Twitter, LinkedIn, Microsoft, GitHub, and more) 
– Adds login buttons to core WordPress login & registration screens (<code>wp-login.php</code>) 
– Shortcodes for custom pages, page builders, and custom login pages 
– Account linking + unlinking (connect multiple providers to one WordPress user) 
– Optional profile sync (name + avatar) 
– Button styles: Light, Dark, Minimal, plus icon-only layouts
Passwordless Login (Magic Link + Email OTP)
<ul>
<li>Built-in security: expiry, resend throttling, single-use links, max attempt limits</li>
<li>Flexible behavior: Login only mode or Login & Register mode (per method)</li>
<li>Per-method redirect overrides (same page, referrer, homepage, custom URL)</li>
<li>Custom emails: edit sender name, subject, and message templates</li>
<li>New: Improved with polished default HTML emails for Magic Link and Email OTP.</li>
</ul>
Guardrails (Spam & signup control) 
– Prevent spam accounts by controlling whether Social Login, Magic Link and Email OTP are allowed to create new users 
– Keep your login screen focused on login only, while still letting existing users sign in with all three methods 
– Your normal WordPress registration form and other registration/onboarding flows continue to work as usual
Admin Tools 
– Basic redirect options for social + passwordless login 
– Diagnostics/logging to debug OAuth and login issues 
– Email notifications (user + admin) when a new account is created via social login
<h3>Pro Add-on (Optional)</h3>
The Pro add-on extends the same login system into popular plugins and adds advanced control:
<ul>
<li>WooCommerce integration for login, checkout and My Account, with Guardrails-aware flows and context-based shortcodes</li>
<li>LMS integrations: LearnDash, LifterLMS, LearnPress</li>
<li>Membership/community integrations: MemberPress, Ultimate Member, Paid Memberships Pro (PMPro), BuddyPress</li>
<li>Passwordless Mode (Off, Recommended, Strict) to control how aggressively passwords are phased out on supported forms while keeping an admin fallback</li>
<li>New: Custom-branded Magic Link & Email OTP emails with your logo, accent color, and footer text</li>
<li>New: Inline Magic Link and Email OTP forms for custom pages, Elementor popups, account dropdowns and custom login layouts.</li>
<li>Advanced redirect rules </li>
<li>Analytics & login insights</li>
<li>Additional diagnostics/logging for complex setups</li>
</ul>
Pro features require the separate <a href="https://wpventra.com/" rel="nofollow ugc">VentraConnect Social Login Pro</a> add-on.
<h3>Roadmap: Passkeys for WordPress</h3>
VentraConnect is being developed as a modern WordPress login suite that currently includes Social Login, Magic Link, Email OTP and Guardrails.
We are also working toward passkey support as a future VentraConnect add-on. The goal is to bring passkey login into the same ecosystem, with fallback options through Magic Link and Email OTP instead of forcing passkey-only access.
<a href="https://wpventra.com/blog/passkeys-for-wordpress-ventraconnect/" rel="nofollow ugc">Read the public passkeys roadmap</a>
<h3>Supported Social Providers</h3>
Google, Facebook, X (Twitter), LinkedIn, Microsoft, GitHub, Discord, Reddit, Slack, Twitch, Spotify, TikTok, Amazon, Yahoo, WordPress.com, LINE.
<h3>How It Works</h3>
<ol>
<li>The user clicks a Social Login button, or requests a Magic Link / Email OTP.</li>
<li>For Social Login, the user authenticates with the provider via official OAuth; for Magic Link / OTP, they verify ownership of their email address.</li>
<li>VentraConnect receives basic profile or email data and looks for an existing WordPress user.</li>
<li>If the email matches an existing user, the login methods are linked to that account and the user is logged in. If not, a new user may be created (subject to your Guardrails and registration settings).</li>
</ol>
<h3>External Services</h3>
VentraConnect Social Login is an OAuth client only.
During login:
<ol>
<li>The user is redirected to the selected provider such as Google or Facebook.</li>
<li>The provider authenticates the user.</li>
<li>The provider returns an authorization token to your site.</li>
<li>VentraConnect retrieves basic profile data:
<ul>
<li>Provider user ID</li>
<li>Email address</li>
<li>Display name</li>
<li>Avatar URL</li>
</ul>
</li>
</ol>
No user data is sent to or stored on servers owned by the plugin author. 
All communication happens directly between your WordPress site and the provider official APIs.
<h3>Provider Domains Used</h3>
Google 
accounts.google.com 
oauth2.googleapis.com 
people.googleapis.com
Facebook 
graph.facebook.com
Microsoft 
login.microsoftonline.com 
graph.microsoft.com
TikTok 
open.tiktokapis.com
Reddit 
www.reddit.com 
oauth.reddit.com
LINE 
access.line.me 
api.line.me
Slack 
slack.com
Discord 
discord.com
Twitch 
id.twitch.tv 
api.twitch.tv
GitHub 
github.com 
api.github.com
Amazon 
www.amazon.com 
api.amazon.com
Yahoo 
api.login.yahoo.com
WordPress.com 
public-api.wordpress.com
LinkedIn 
www.linkedin.com 
api.linkedin.com
Each provider has its own Terms of Service and Privacy Policy. You are responsible for complying with those terms when enabling a provider.

Social Login, Magic Link & Email OTP – Passwordless Login by VentraConnect

Social login with 15+ providers plus passwordless login (Magic Link & Email OTP), with Guardrails to block spam registrations.

QRAuth – Passwordless & Social Login vs Social Login, Magic Link & Email OTP – Passwordless Login by VentraConnect