Authyo | OTP

WooCommerce

Authyo Authentication and Notification for WooCommerce

Let customers log in, register and check out with a one-time password sent to their email or phone, and keep them updated with automatic WooCommerce order notifications by Email, SMS and WhatsApp.

  • WordPress 5.0+
  • PHP 7.4+
  • Requires WooCommerce 5.0+
  • Updated
  1. Install Add WooCommerce and the Authyo plugin.
  2. Connect Paste your App ID, Client ID and Client Secret.
  3. Go live Add the login and registration shortcodes.

Note: Voice Call OTP is currently available only in India.

At a glance

What it does
Adds OTP login, registration and checkout verification to WooCommerce, and sends order status notifications to customers.
OTP channels
Email, SMS, WhatsApp and Voice Call (Voice Call is available in India only).
Notification channels
Email, SMS and WhatsApp.
You need
WooCommerce 5.0+, WordPress 5.0+, PHP 7.4+, and an Authyo account with an App ID, Client ID and Client Secret.
Settings location
WordPress admin, under WC OTP Auth (Settings, Shortcodes, Notification Flow and Documentation).
Shortcodes
[authyo_otp_login] and [authyo_otp_register].
Compatibility
Works with WooCommerce High-Performance Order Storage (HPOS) and the Cart and Checkout Blocks.

Overview

Authyo Authentication and Notification for WooCommerce lets customers log in, register and check out with a one-time password (OTP) sent to their email or phone. There is no password to remember or reset. The plugin also sends automatic order status notifications.

OTPs and notifications are delivered through your Authyo account. You choose which channels to turn on, which one is tried first, and whether to fall back to another channel if delivery fails.

  • OTP login and registration

    Add a login or registration form to any page with a shortcode. Customers sign in or sign up with a code sent to their email or phone.

  • Checkout verification

    Ask customers to verify their email and phone before they can place an order. Works with the classic checkout and the Checkout Block.

  • Order notifications

    Send Email, SMS or WhatsApp messages automatically when an order changes status.

  • Four OTP channels

    Email, SMS, WhatsApp and Voice Call. Voice Call is currently available for India only.

  • Priority and fallback

    Choose which channel is tried first, and fall back automatically if delivery fails.

  • Country selector

    A country code selector on phone fields, with a default country you can preselect.

  • Security controls

    Limits on failed attempts, a lockout period and rate limiting protect against abuse.

  • Testing mode

    Skip OTP for test emails and phone numbers so you can try your store without sending real codes.

Requirements

  • WordPress 5.0 or later and PHP 7.4 or later.
  • WooCommerce 5.0 or later installed and activated.
  • An Authyo account with an application. You will need its App ID, Client ID and Client Secret.
  • Credits in your Authyo account to send OTPs and notifications.

Installation

Install WooCommerce first, then the Authyo plugin.

  1. Install and activate WooCommerce

    Go to Plugins → Add New, search for WooCommerce, then click Install Now and Activate. Skip this step if your store is already running.

  2. Install the Authyo plugin

    Go to Plugins → Add New, search for Authyo Authentication and Notification for WooCommerce, then click Install Now and Activate. You can also upload the plugin ZIP using Plugins → Add New → Upload Plugin.

  3. Open the plugin menu

    A WC OTP Auth item (with a lock icon) appears in the WordPress admin menu. It has four pages: Settings, Shortcodes, Notification Flow and Documentation.

Setup

Connect the plugin to your Authyo account, choose where OTP is used, and create your login and registration pages.

  1. Create your Authyo account

    Go to app.authyo.io and create a free account.

  2. Copy your credentials

    Open your applications in the Authyo dashboard. The App ID, Client ID and Client Secret are listed together. Create an application first if you do not have one.

  3. Paste them into the General tab

    In WordPress go to WC OTP Auth → Settings → General. Under API Credentials, fill in Authyo App ID, Authyo Client ID and Authyo Client Secret, then save. Each field shows Configured or Not set, and the secret is masked.

    The Setup Checklist at the top of the settings page shows what is still missing: credentials, at least one delivery method, OTP turned on for login or registration, and the login and registration pages.

  4. Choose where OTP is used

    Under Basic Settings, switch on what you need: Enable OTP on Login, Enable OTP on Registration, Enable OTP Verification at Checkout and Enable WooCommerce Order Notifications.

  5. Choose your delivery methods

    Under OTP Methods for Login & Register, switch on Email, WhatsApp, SMS and Voice Call. If you use checkout verification, choose the methods for it under OTP Methods for Checkout. Voice Call is currently available for India only, so turn on fallback for other countries.

  6. Create your login and registration pages

    Go to WC OTP Auth → Shortcodes and click Create All Missing Pages. This creates a Login page and a Registration page with the right shortcode already inside. Or create the pages yourself, as shown in the next section.

If the plugin shows a notice about missing credentials or disabled fallback methods, open Settings from the notice and complete those fields.

How to use

Place a shortcode on any page to show the OTP form. Customers can enter either an email address or a mobile number. The plugin detects which one it is and sends the code on the right channel.

  1. Add the login form

    Create a page, for example “Login”, add a Shortcode block with the code below, and publish it.

    [authyo_otp_login]
  2. Add the registration form

    Create another page, for example “Register”, and add this shortcode.

    [authyo_otp_register]

    The plugin also accepts [authyo_otp_auth_login], [authyo_otp_auth_register] and [authyo_otp_auth] (the login form). Use whichever you prefer.

  3. What customers do at login

    The customer enters their email or mobile number and requests the code. They type the code they receive and are signed in. The customer must already have an account.

  4. What customers do at registration

    The customer fills in their details, requests the code, enters it, and the account is created.

  5. What customers do at checkout

    With Enable OTP Verification at Checkout on, the customer verifies their email address (and phone number, if a phone method is on) on the checkout page. The Place Order button unlocks only after verification. The verification is stored on the server for the session, so it cannot be skipped by editing the form.

  6. Test your store

    Switch on Testing Mode under Advanced and add a test email or phone number. For those entries OTP is skipped and verification always succeeds, so you can test without sending real codes. Turn it off before going live.

Settings reference

Every setting in the plugin, grouped by where you find it under WC OTP Auth → Settings. Default values are shown next to the setting name.

General: API credentials 3
Authyo App ID
The App ID of your Authyo application.
Authyo Client ID
The Client ID of your Authyo application.
Authyo Client Secret
The Client Secret of your Authyo application. It is masked after you save it.
General: basic settings 4
Enable OTP on Login
Require OTP verification when customers log in.
Enable OTP on Registration
Require OTP verification when customers register.
Enable OTP Verification at Checkout
Require customers to verify their email and phone before placing an order.
Enable WooCommerce Order Notifications
Send order status notifications by Email, SMS and WhatsApp. You set these up in Notification Flow.
General: OTP methods for login and register 4
Send OTP via Email
Deliver the code to the customer’s inbox.
Send OTP via WhatsApp
Deliver the code as a WhatsApp message.
Send OTP via SMS
Deliver the code as a text message.
Send OTP via Voice Call
Read the code aloud in an automated call. Available for India only.
General: checkout verification 2

These settings appear when checkout verification is on. The same four methods (Email, WhatsApp, SMS and Voice Call) can be chosen separately for checkout.

OTP Methods for Checkout
Choose which of Email, WhatsApp, SMS and Voice Call are offered at checkout.
Checkout OTP Position Default: Billing Address only
Where the phone OTP field appears on the checkout page: Billing Address only, Shipping Address only, or Both Billing & Shipping. The email OTP always appears in the billing section.
Advanced: OTP configuration 4
OTP Length Default: 6
Number of digits in the code. Allowed range: 4 to 8.
OTP Expiry Time Default: 300
How long a code stays valid, in seconds. Allowed range: 10 to 600.
Maximum OTP Attempts Default: 5
How many wrong codes a visitor can enter before being blocked. Allowed range: 1 to 20.
Lockout Period Default: 15
How long a visitor is blocked, in minutes, after reaching the maximum attempts. Allowed range: 1 to 1440. Use a low value while testing and 30 or more in production.
Advanced: priority and fallback 3
Priority Method Default: WhatsApp
The channel tried first for phone numbers: WhatsApp, SMS or Voice Call.
Enable Fallback Method Default: On
If the priority method fails, the plugin retries with SMS, then Voice Call, if those are enabled. Leaving this on is recommended.
Allow Visitor Method Choice Default: Off
Shows a selector before the code is sent so visitors can pick WhatsApp, SMS or Voice Call. It needs two or more phone methods enabled.
Advanced: testing mode 3
Enable OTP bypass for testing
Skip OTP verification for the test numbers and emails you list. Turn it off on a live store.
Test Phone Numbers
One number per line, with country code, for example +1234567890.
Test Email Addresses
One email address per line, for example test@example.com.
Advanced: country codes 2
Default Country
The country preselected in the phone number field on the login and registration forms.
Country Codes Cache
The country list is fetched from the Authyo API and stored until you clear it. Use Clear & Refresh Country List to update it. The page shows how many countries are loaded and when they were last updated.
Advanced: phone validation 1
Enable libphonenumber validation
Uses Google’s phone number library to check numbers in real time on the login and registration forms. Invalid or mismatched numbers are flagged before the code is sent.
Shortcodes page 3
Create Login Page
Creates a published page with the login shortcode already inside, if it does not exist.
Create Registration Page
Creates a published page with the registration shortcode already inside, if it does not exist.
Create All Missing Pages
Creates whichever of the two pages is missing, in one click.

Set up order notifications

Order notifications send an automatic message when a WooCommerce order changes status. Switch on Enable WooCommerce Order Notifications in the General tab first. Then open WC OTP Auth → Notification Flow.

  1. Add a flow

    Click Add Flow on the left.

  2. Choose a WooCommerce event

    Select the order status that should trigger a message: Pending, Processing, On-hold, Completed, Cancelled, Refunded or Payment Failed.

  3. Choose delivery channels

    Pick Email, SMS, WhatsApp, or any combination.

  4. Save the flow

    Each event uses a ready-made template from your Authyo account. The flow card shows the template name, with a link to view the available templates.

  5. Manage your flows

    Each flow has an on and off switch, so you can pause it without deleting it. You can also edit or delete a flow, or use Edit All Flows and Delete All Flows to change them in bulk.

    If an event’s template is not yet available, no message is sent for that event. A notification is also skipped when the customer has no email address or a valid phone number for the channel you chose.

Troubleshooting

Most problems have a quick fix. Find your issue below.

I see a notice about missing API credentials
Open WC OTP Auth → Settings → General and fill in the App ID, Client ID and Client Secret from your Authyo dashboard. The Setup Checklist shows what is left to do.
The OTP does not arrive
Check that your credentials are correct, that the channel is switched on in OTP Methods, that your Authyo account has credits, and that the mobile number includes the correct country. Turn on Enable Fallback Method so another channel is tried automatically. Voice Call works only for India.
Customers see “No account found with this mobile number” or “…with this email address”
Login needs an existing account. The email or mobile number must match a registered customer. New customers should use the registration form.
Customers see “An account already exists with this mobile number” or “…email address”
The details are already registered. Ask the customer to use the login form instead.
Customers see “Too many OTP requests. Please try again in a few minutes”
The plugin allows up to 5 OTP requests per 10 minutes for each email and IP address. The customer should wait a few minutes and try again.
Customers are blocked after wrong codes
After the Maximum OTP Attempts is reached, the customer is locked out for the Lockout Period, then can try again. Both are set under Advanced. The defaults are 5 attempts and 15 minutes.
Customers see “Invalid session. Please request a new OTP”
The code expired or the session was lost. The default expiry is 300 seconds. Ask the customer to request a new code, or raise OTP Expiry Time (up to 600 seconds).
Customers see “Security check failed. Please try again”
This is usually a cached page. Clear your page cache and CDN cache, then reload the page. Exclude the login, registration and checkout pages from caching.
The login or registration form does not appear
Check that the page contains [authyo_otp_login] or [authyo_otp_register], that OTP is switched on for that form under Basic Settings, and that you saved the settings. A customer who is already signed in sees a message instead of the form.
The Place Order button stays locked at checkout
The customer must verify the OTP first. Check that Enable OTP Verification at Checkout is on and that at least one method is enabled for checkout. If it is a test order, add the email or number to Testing Mode.
Order notifications are not sent
Check that Enable WooCommerce Order Notifications is on, that a flow exists for the order status with the flow switched on, and that the customer’s email or phone number is valid. Events whose template is not yet available are skipped.
The country list is empty or out of date
Go to Advanced → Country Codes Cache and click Clear & Refresh Country List.

Frequently asked questions

Do I need an Authyo account?
Yes. The plugin sends OTPs and notifications through the Authyo API. Create an account, then copy your App ID, Client ID and Client Secret into the plugin settings.
Which channels can I use for OTP?
Email, SMS, WhatsApp and Voice Call. Voice Call is currently available for India only. You can turn on one or several channels, set a priority channel and enable automatic fallback.
Can customers log in with a phone number?
Yes. Customers can enter either an email address or a mobile number, and the plugin sends the code on the right channel.
Does it support international phone numbers?
Yes. Phone fields include a country code selector for countries worldwide, and you can preselect a default country.
Does OTP at checkout work with the Checkout Block?
Yes. It works with both the classic WooCommerce checkout and the Checkout Block.
Is it compatible with HPOS?
Yes. The plugin is compatible with WooCommerce High-Performance Order Storage.
Can I keep password login as well?
Yes. The OTP form appears only on pages where you place the shortcode, so the default WooCommerce login remains available alongside it.
What if a customer does not receive the code?
If fallback is on, the plugin tries another channel automatically. Customers also see a “Try another method” option in the form.
How long is an OTP valid?
By default 300 seconds (5 minutes). You can set it between 10 and 600 seconds under Advanced → OTP Configuration.
Which order events can send notifications?
Pending, Processing, On-hold, Completed, Cancelled, Refunded and Payment Failed, by Email, SMS and WhatsApp. Each event can use one or several channels.
Can I test without sending real OTPs?
Yes. Switch on Testing Mode under Advanced and list your test emails and phone numbers. OTP is skipped for those entries.

Still need help?

If you couldn’t find the answer in this guide, submit our support form and the Authyo team will get back to you.

Get support