Authyo | OTP

Menu
Menu
Form integrations

Authyo OTP for Everest Forms

Add email and phone OTP verification to your Everest Forms forms. Switch OTP on for a form, or add an Authyo field, and verify visitors by Email, SMS, WhatsApp or Voice Call before they can submit.

  • WordPress 5.5+
  • PHP 7.4+
  • Requires Everest Forms
  • Updated
Get the plugin
  1. Install Add Everest Forms and the Authyo add-on.
  2. Connect Paste your Client ID and Client Secret.
  3. Turn on a form Switch OTP on in the Forms tab.

Note: Voice Call OTP is currently available only in India.

At a glance

What it does
Adds one-time-password (OTP) verification for email addresses and phone numbers to Everest Forms forms.
OTP channels
Email, SMS, WhatsApp and Voice Call (Voice Call is available in India only).
Two ways to add OTP
Switch a form on in the Forms tab, so its normal Email and Phone fields are verified. Or add the Authyo Email, Authyo Phone or Authyo Email / Phone field from General Fields.
You need
Everest Forms, WordPress 5.5+, PHP 7.4+, and an Authyo account with a Client ID and Client Secret.
Settings location
WordPress admin, under Authyo OTP.
Safety net
If your Authyo wallet balance runs out, forms keep accepting submissions without OTP and you get an email about it. This protection is on by default and can be turned off.

Overview

Authyo OTP for Everest Forms adds a one-time-password check to your Everest Forms forms. Visitors verify their email address or phone number before the form can be submitted, which reduces spam and fake submissions.

The quickest way is the Forms tab: switch OTP on for a form and its normal Email and Phone fields are verified automatically, with no change to the form itself. If you prefer, you can add the dedicated Authyo fields to a form instead.

This plugin is an independent add-on for Everest Forms, developed by Konceptwise Digital Media Pvt. Ltd. It is not affiliated with, endorsed by or supported by Everest Forms.

  • Per-form switch

    Turn OTP on for the forms you choose. Their existing Email and Phone fields stay exactly as they are, and are verified automatically.

  • Dedicated Authyo fields

    Add Authyo Email, Authyo Phone or the smart Authyo Email / Phone field from General Fields.

  • Four OTP channels

    Email, SMS, WhatsApp and Voice Call. Voice Call is currently available in India only.

  • Send a test OTP

    Send one real code to yourself to confirm your keys and channels work.

  • Guided setup

    A setup walkthrough and a progress meter show what is left to do.

  • Country selector

    Show all countries or only the ones you serve, and preselect a default country.

  • Abuse limits

    Built-in limits on how often codes can be sent protect your Authyo balance.

  • Fail-safe protection

    If your balance runs out, forms keep working and you are emailed once a day. You can switch this off to block submissions instead.

Requirements

  • WordPress 5.5 or later and PHP 7.4 or later.
  • Everest Forms installed and activated.
  • An Authyo account with an application. You will need its Client ID and Client Secret.
  • Balance in your Authyo wallet to send OTPs.

Installation

Install Everest Forms first, then the Authyo add-on.

  1. Install and activate Everest Forms

    Go to Plugins → Add New, search for Everest Forms, then click Install Now and Activate. Skip this step if it is already active.

  2. Install Authyo OTP for Everest Forms

    Go to Plugins → Add New, search for Authyo OTP for Everest Forms, then click Install Now and Activate. You can also upload the plugin ZIP using Plugins → Add New → Upload Plugin.

  3. Open the plugin settings

    A new Authyo OTP item appears in the WordPress admin menu. The settings page has five tabs: General, Verification Methods, Forms, How to Use and Support. At the top, a status shows OTP is live, OTP is switched off or Setup needed.

Setup

Connect the plugin to your Authyo account and choose how OTPs are sent. You can use Setup Authyo for a guided walkthrough, or fill in the tabs yourself.

  1. Create your Authyo account

    Go to app.authyo.io and create a free account.

  2. Copy your credentials

    Open your applications in the Authyo dashboard and copy the Client ID and Client Secret. Create an application first if you do not have one.

  3. Paste them into the General tab

    In WordPress go to Authyo OTP → General. Under API Credentials, enter the Client ID and Client Secret, then click Save Changes. Until you do this, forms submit without verification.

  4. Choose your verification channels

    Open the Verification Methods tab. Under Verification Channels, switch on Email, SMS, WhatsApp and Voice Call as needed, and pick a Primary Channel (Phone). Voice Call is currently available only for India. If no phone channel is on, phone fields are not verified and do not block a form.

  5. Send a test OTP

    On the same tab, use Send a test OTP. Choose Email OTP or a phone channel, enter your own email address or phone number, and click Send test OTP. Type the code you receive and click Verify code. This uses one OTP from your Authyo balance and confirms everything works.

Next, turn OTP on for your forms in the Forms tab (see the next section).

How to use

There are two ways to add OTP to a form. Use either one, or both on different forms.

  1. Option 1: switch a form on in the Forms tab

    Open Authyo OTP → Forms. Switch on each form you want to protect. On those forms, the normal Email and Phone fields must be verified with a one-time code before the form can be submitted. Use Turn all on or Turn all off to change every form at once, and the search box to find a form. Forms you leave off are not affected.

    The form’s own fields are never replaced. Their IDs, names and stored entries stay exactly as they were, and the OTP controls are added next to them. A form that already contains an Authyo field is always verified, whatever its switch says. A form with no Email or Phone field is marked so you can see there is nothing to verify.

  2. Option 2: add an Authyo field

    Edit a form with Everest Forms → All Forms. In the General Fields section, add Authyo Email to verify an email address, Authyo Phone to verify a phone number, or Authyo Email / Phone, a smart field that accepts either one.

  3. Save and test

    Save the form and open it on your site. Enter an email address or phone number, request the code, enter it and submit. If a visitor submits without verifying, the form says “Verification is required. Please verify before submitting”.

Forms that existed before version 1.0.4 are not affected until you switch them on, because the per-form switch is off by default.

Settings reference

Every setting in the plugin, grouped by the tab where you find it under Authyo OTP.

General: API credentials 4
Client ID
The Client ID of your Authyo application.
Client Secret
The Client Secret of your Authyo application. After saving it shows Saved. Leave it blank to keep the saved value.
Remove my saved keys when I save
Deletes your stored credentials. OTP stops working until you add new ones.
Let Authyo know when this plugin is activated or deactivated (optional)
Never ticked by default. When ticked, and a Client ID is saved, the plugin tells Authyo when it is activated or deactivated: the event, your site address, plugin, WordPress and PHP versions, your Client ID and the time. Your Client Secret, form entries and visitor data are never sent.
General: failsafe protection 1
Let forms submit without OTP when my wallet is empty Default: On
When on, forms keep accepting submissions if your Authyo wallet runs out, so you do not lose leads, and you are emailed once a day. Turn it off to block submissions instead.
Verification Methods: channels 5
Email, SMS, WhatsApp, Voice Call
Switch on the channels you want to offer. Voice Call is available only in India.
Primary Channel (Phone)
The channel used first for phone numbers: SMS, WhatsApp or Voice Call. Fallback options appear after 1 minute.
Allow visitor to choose method
When on, visitors see a button for each enabled channel straight away, instead of a single “Send OTP” button.
Strict Validation (Multi-page Forms)
When on, visitors cannot move to the next page of a multi-step form until the Authyo fields on the current page are verified.
Send a test OTP
Sends one real code, using your saved keys, to your own email address or phone number. It uses one OTP from your balance.
Verification Methods: optional verification 2

By default verification is mandatory. These options add a Skip Verification button to the form.

Allow Skip for Email OTP
Let visitors submit without verifying their email address.
Allow Skip for Phone OTP
Let visitors submit without verifying their phone number.
Verification Methods: country selection 3
Select All Countries / Select Specific Countries
Show every country in the phone field dropdown, or only the ones you choose.
Default Country
The country preselected in the phone field. Visitors can still change it.
Country List Cache
The country list is cached. Use Refresh Cache to fetch the latest list. If Authyo cannot be reached, the list you already have keeps working.
Verification Methods: OTP defaults 4
OTP Length Default: 6
Number of digits in the code. Allowed range: 4 to 8.
Expiry (minutes) Default: 5
How long a code stays valid. Allowed range: 1 to 10.
Resend Cooldown (seconds) Default: 60
The wait before another code can be sent to the same contact. Allowed range: 10 to 120.
Max Resends Default: 3
How many times a code can be re-sent to the same contact within 10 minutes. Allowed range: 1 to 5.
Forms 3
Form switch Default: Off
Turn OTP on for a form. Its normal Email and Phone fields must then be verified before submit.
Turn all on / Turn all off
Change every form at once.
Search forms
Find a form by name. The tab also shows how many forms are on.
Form fields (in the Everest Forms builder) 3
Authyo Email
A field that verifies an email address with an OTP.
Authyo Phone
A field that verifies a phone number by SMS, WhatsApp or Voice Call, with a country selector.
Authyo Email / Phone
A smart field that accepts either an email address or a phone number.

How code sending is limited

To protect your Authyo balance from abuse, the plugin limits how often codes can be sent. These limits are built in.

  1. Per contact

    A second code to the same email or phone number must wait for the Resend Cooldown (default 60 seconds). A contact can receive up to Max Resends + 1 codes in 10 minutes (default 4), and up to 10 codes a day from anyone.

  2. Per visitor

    One visitor can request up to 30 codes every 10 minutes and 150 codes a day, to any contact.

  3. Whole site

    The site as a whole can send up to 500 codes an hour.

  4. Behind Cloudflare or a load balancer

    The limits are counted per visitor IP address. If your host does not pass on the visitor’s real IP address, every visitor looks the same and shares one limit, so people see “Too many attempts”. Ask your host to restore the real IP, or return it with the authyo_evf_client_ip filter.

Troubleshooting

Most problems have a quick fix. Find your issue below.

The status says “Setup needed”
Add your Client ID and Client Secret in the General tab, or use Setup Authyo. Until then forms submit without verification.
The status says “OTP is switched off”
Your keys are saved but verification is turned off. Open Setup Authyo to switch it back on.
I see “Your saved Authyo keys could not be read”
The WordPress security keys (salts) in wp-config.php were changed after your keys were saved. Enter your Client ID and Client Secret again and save.
I see a message about OpenSSL
The OpenSSL PHP extension is not available on your server, so saved keys are only encoded and not encrypted. Ask your host to enable OpenSSL.
I see “Your Authyo balance is low”
OTP was skipped recently so your forms kept working. Top up your Authyo wallet to keep verifying visitors.
The OTP does not arrive
Use Send a test OTP to check your keys and channels. Check that the channel is switched on, that your Authyo wallet has balance, and that the email address or phone number is valid. Voice Call works only for India.
The form submits without asking for an OTP
Check that OTP is switched on for that form in the Forms tab (or that it has an Authyo field), that your keys are set, and that your wallet has balance. With the failsafe on, an empty wallet lets forms submit without OTP. Phone fields are also not verified if no phone channel is switched on.
Visitors see “Too many attempts” or “Too many verification attempts”
The visitor reached a limit. They should wait a few minutes. If many visitors see it, your site may be behind Cloudflare or a load balancer that hides real IP addresses. See “How code sending is limited”.
Visitors see “Session expired. Send OTP again”
The code timed out. By default a code is valid for 5 minutes. Ask the visitor to request a new one, or raise Expiry (minutes) (up to 10).
Visitors see “Verification is required. Please verify before submitting”
The visitor must verify before submitting. If you prefer, switch on Allow Skip for Email OTP or Allow Skip for Phone OTP.
Visitors see “The value entered does not match the one that was verified”
The visitor changed their email or phone after verifying it. They need to verify the new value.
Visitors see “Voice Call in the selected country is not available”
Voice Call works only for India. Ask the visitor to choose SMS or WhatsApp, or switch off Voice Call.
A multi-page form will not move to the next page
Strict Validation (Multi-page Forms) is on, so the Authyo fields on the current page must be verified first.

Frequently asked questions

Does this plugin require Everest Forms?
Yes. It is an extension for Everest Forms and needs it installed and activated.
Which OTP methods are supported?
Email, SMS, WhatsApp and Voice Call. Voice Call is currently available only for India.
Is an Authyo account required?
Yes. You need an Authyo account and an application to get your Client ID and Client Secret.
Do I have to change my forms to use OTP?
No. Switch a form on in the Forms tab and its existing Email and Phone fields are verified automatically. You can also add the dedicated Authyo fields if you prefer.
Will it change my existing form fields or entries?
No. The form’s own fields are never replaced. Their IDs, names and stored entries stay the same.
Are my existing forms affected when I install it?
No. The per-form switch is off by default, so forms stay as they are until you turn them on.
What happens if my Authyo balance runs out?
With the failsafe on (the default), forms keep accepting submissions without OTP so you do not lose leads, and you are emailed once a day. Turn the setting off to block submissions instead.
Can I test it without a real visitor?
Yes. Use Send a test OTP on the Verification Methods tab. It sends one real code to your own email or phone and uses one OTP from your balance.
Is any data sent to Authyo about my site?
Only if you tick the optional activation notice box. Even then, only the event, site address, versions, Client ID and time are sent.
Is this plugin made by the Everest Forms team?
No. It is developed by Konceptwise Digital Media Pvt. Ltd. and is not affiliated with, endorsed by or supported by Everest Forms.

Still need help?

If you couldn’t find the answer in this guide, submit our support form and the Authyo team will get back to you.

Get support