jeremyjsimmons

<p>TWL SSO is a secure single sign-on plugin for WordPress that enables seamless authentication using RS256 JWT tokens from an external SSO application.<br />
This plugin provides login security features and is designed for allowing Twelve Legs Marketing centralized authentication management.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Single Sign In</strong>: Agency employees can log into websites they manage from a central dashboard.</li>
<li><strong>Just-in-Time User Provisioning</strong>: Automatic user creation and role assignment</li>
<li><strong>JWT Validation</strong>: Full RS256 signature verification with JWKS endpoint integration</li>
<li><strong>Key Rotation</strong>: Support key rotation through JWKS endpoint</li>
<li><strong>Role Management</strong>: Flexible role assignment from JWT claims</li>
<li><strong>Referrer Validation</strong>: Enhanced security through referrer validation</li>
<li><strong>Audience Validation</strong>: Ensures tokens are valid for the specific WordPress site</li>
<li><strong>Token Expiration</strong>: Built-in token expiration and clock skew tolerance</li>
<li><strong>Email Validation</strong>: Comprehensive email validation with optional allowlist</li>
<li><strong>Caching</strong>: JWKS caching for improved performance</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Referrer validation to prevent unauthorized access</li>
<li>JWT signature verification using public key cryptography</li>
<li>Issuer validation to ensure tokens come from trusted sources</li>
<li>Audience validation to prevent token reuse across sites</li>
<li>Token expiration validation with configurable leeway</li>
<li>Email format validation and filtering via hook</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>WordPress installations managed centrally by agency</li>
<li>Organization using Google for external identity provider</li>
</ul>
<h3>Usage</h3>
<h4>Authentication Flow</h4>
<ol>
<li>User clicks login link from SSO application sso.twelvelegsmarketing.com</li>
<li>SSO application redirects to WordPress with JWT token: <code>/wp-login.php?action=twl_sso&token=JWT_TOKEN</code></li>
<li>Plugin validates the JWT token signature and claims</li>
<li>Plugin extracts user information from JWT claims</li>
<li>Plugin creates or retrieves WordPress user</li>
<li>Plugin assigns appropriate role based on JWT claims</li>
<li>User is logged into WordPress</li>
</ol>
<h4>JWT Claims</h4>
<p>The plugin expects the following JWT claims:</p>
<ul>
<li><code>email</code> or <code>sub</code>: User’s email address</li>
<li><code>iss</code>: Issuer (must match allowed issuers)</li>
<li><code>aud</code>: Audience (must match WordPress site URL)</li>
<li><code>exp</code>: Expiration time</li>
<li><code>nbf</code>: Not before time (optional)</li>
<li><code>wp_role</code>: WordPress role to assign (optional)</li>
<li><code>name</code>: User’s display name (optional)</li>
<li><code>given_name</code>: User’s first name (optional)</li>
<li><code>family_name</code>: User’s last name (optional)</li>
</ul>
<h4>Configuration</h4>
<p>The plugin automatically configures itself based on the WordPress environment:</p>
<ul>
<li><strong>Production</strong>: Only allows <code>https://sso.twelvelegsmarketing.com</code> as issuer</li>
<li><strong>Development/Staging</strong>: Also allows <code>https://localhost:8443</code> as issuer</li>
</ul>
<h4>Customization</h4>
<p>You can customize the plugin behavior using WordPress filters:</p>
<ul>
<li><code>twl_sso_allow_email</code>: Filter to control which email addresses are allowed</li>
<li><code>twl_sso_allowed_roles</code>: Filter to control which roles can be assigned</li>
<li><code>twl_sso_allowed_issuers</code>: Filter to control which issuers are allowed</li>
</ul>
<h3>Support</h3>
<p>For support, please contact Twelve Legs Marketing at https://twelvelegsmarketing.com</p>
<h3>Privacy Policy</h3>
<p>This plugin does not collect, store, or transmit any personal data. All authentication is handled through secure JWT tokens from your configured SSO provider.</p>


Twelve Legs Marketing SSO

Single sign-on plugin for WordPress that accepts RS256 JWTs from the TWL SSO application for secure authentication.

hippooo

hippoosupport

<p><strong>Hippoo Auth</strong> enhances the WooCommerce Store API by adding secure JWT-based authentication endpoints. It supports login and signup via Google, Facebook, Apple, or manually with email and password. Once authenticated, users can retrieve and update their billing/shipping information, view order history, and more — all via API.</p>
<p>Perfect for developers building API-driven themes, custom mobile apps, or headless WooCommerce experiences.</p>
<p>Use it to build:</p>
<ul>
<li>Headless WooCommerce themes</li>
<li>Custom frontend apps (React, Vue, etc.)</li>
<li>Mobile apps using Flutter, React Native, or Kotlin</li>
<li>API-based user dashboards</li>
</ul>
<p>With Hippoo Auth, users can register, login (manually or via Google, Apple, or Facebook), and securely access:</p>
<ul>
<li>Order history and details  </li>
<li>Billing and shipping addresses  </li>
<li>JWT-based session tokens with refresh support  </li>
</ul>
<p>🔐 Auth is handled via JWT for secure stateless sessions, ideal for frontend-heavy or decoupled environments.</p>
<p>📘 <strong>Developer Docs:</strong><br />
<a href="https://hippoo.app/hippoo-auth-web-service-documentation-for-authentication-and-user-management-in-woocommerce/" rel="nofollow ugc">https://hippoo.app/hippoo-auth-web-service-documentation-for-authentication-and-user-management-in-woocommerce/</a></p>
<h3>Features</h3>
<ul>
<li>REST API login with JWT tokens  </li>
<li>Social login (Google, Facebook, Apple)  </li>
<li>Secure signup and password reset  </li>
<li>Access to orders and addresses via API  </li>
<li>Built-in token refresh and logout endpoint  </li>
<li>Compatible with WooCommerce stores and custom frontends  </li>
<li>No dependency on the Hippoo App</li>
</ul>
<h3>External services</h3>
<p>This plugin connects to third-party services for social authentication:</p>
<ul>
<li>
<p><strong>Google OAuth API</strong>: Used to verify Google login tokens. Sends OAuth access token.<br />
<a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>, <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms of Service</a></p>
</li>
<li>
<p><strong>Facebook Graph API</strong>: Used to fetch user info (ID, email, name). Sends OAuth access token.<br />
<a href="https://www.facebook.com/about/privacy" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.facebook.com/legal/terms" rel="nofollow ugc">Terms</a></p>
</li>
<li>
<p><strong>Apple ID Authentication API</strong>: Used for sign-in via Apple. Sends OAuth access token.<br />
<a href="https://www.apple.com/legal/privacy/en-ww/" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.apple.com/legal/internet-services/" rel="nofollow ugc">Terms</a></p>
</li>
</ul>
<p>These are required for enabling social login functionality.</p>
<h3>Credits</h3>
<p>This plugin was built with the Hippoo team — creators of the <a href="https://hippoo.app" rel="nofollow ugc">Hippoo WooCommerce App</a>, a mobile app that helps you manage store orders, products, coupons, and more on the go.</p>


Hippoo Auth

Extend your WooCommerce Store API with secure authentication endpoints for social and manual login. Ideal for custom apps, headless themes, or fronten …

Twelve Legs Marketing SSO vs Hippoo Auth