Note: Voice Call OTP is currently available only in India.
At a glance
- What it does
- Adds OTP login, registration and checkout verification to WooCommerce, and sends order status notifications to customers.
- OTP channels
- Email, SMS, WhatsApp and Voice Call (Voice Call is available in India only).
- Notification channels
- Email, SMS and WhatsApp.
- You need
- WooCommerce 5.0+, WordPress 5.0+, PHP 7.4+, and an Authyo account with an App ID, Client ID and Client Secret.
- Settings location
- WordPress admin, under WC OTP Auth (Settings, Shortcodes, Notification Flow and Documentation).
- Shortcodes
[authyo_otp_login]and[authyo_otp_register].- Compatibility
- Works with WooCommerce High-Performance Order Storage (HPOS) and the Cart and Checkout Blocks.
Overview
Authyo Authentication and Notification for WooCommerce lets customers log in, register and check out with a one-time password (OTP) sent to their email or phone. There is no password to remember or reset. The plugin also sends automatic order status notifications.
OTPs and notifications are delivered through your Authyo account. You choose which channels to turn on, which one is tried first, and whether to fall back to another channel if delivery fails.
-
OTP login and registration
Add a login or registration form to any page with a shortcode. Customers sign in or sign up with a code sent to their email or phone.
-
Checkout verification
Ask customers to verify their email and phone before they can place an order. Works with the classic checkout and the Checkout Block.
-
Order notifications
Send Email, SMS or WhatsApp messages automatically when an order changes status.
-
Four OTP channels
Email, SMS, WhatsApp and Voice Call. Voice Call is currently available for India only.
-
Priority and fallback
Choose which channel is tried first, and fall back automatically if delivery fails.
-
Country selector
A country code selector on phone fields, with a default country you can preselect.
-
Security controls
Limits on failed attempts, a lockout period and rate limiting protect against abuse.
-
Testing mode
Skip OTP for test emails and phone numbers so you can try your store without sending real codes.
Requirements
- WordPress 5.0 or later and PHP 7.4 or later.
- WooCommerce 5.0 or later installed and activated.
- An Authyo account with an application. You will need its App ID, Client ID and Client Secret.
- Credits in your Authyo account to send OTPs and notifications.
Installation
Install WooCommerce first, then the Authyo plugin.
Install and activate WooCommerce
Go to Plugins → Add New, search for WooCommerce, then click Install Now and Activate. Skip this step if your store is already running.
Install the Authyo plugin
Go to Plugins → Add New, search for Authyo Authentication and Notification for WooCommerce, then click Install Now and Activate. You can also upload the plugin ZIP using Plugins → Add New → Upload Plugin.
Open the plugin menu
A WC OTP Auth item (with a lock icon) appears in the WordPress admin menu. It has four pages: Settings, Shortcodes, Notification Flow and Documentation.
Setup
Connect the plugin to your Authyo account, choose where OTP is used, and create your login and registration pages.
Create your Authyo account
Go to app.authyo.io and create a free account.
Copy your credentials
Open your applications in the Authyo dashboard. The App ID, Client ID and Client Secret are listed together. Create an application first if you do not have one.
Paste them into the General tab
In WordPress go to WC OTP Auth → Settings → General. Under API Credentials, fill in Authyo App ID, Authyo Client ID and Authyo Client Secret, then save. Each field shows Configured or Not set, and the secret is masked.
The Setup Checklist at the top of the settings page shows what is still missing: credentials, at least one delivery method, OTP turned on for login or registration, and the login and registration pages.
Choose where OTP is used
Under Basic Settings, switch on what you need: Enable OTP on Login, Enable OTP on Registration, Enable OTP Verification at Checkout and Enable WooCommerce Order Notifications.
Choose your delivery methods
Under OTP Methods for Login & Register, switch on Email, WhatsApp, SMS and Voice Call. If you use checkout verification, choose the methods for it under OTP Methods for Checkout. Voice Call is currently available for India only, so turn on fallback for other countries.
Create your login and registration pages
Go to WC OTP Auth → Shortcodes and click Create All Missing Pages. This creates a Login page and a Registration page with the right shortcode already inside. Or create the pages yourself, as shown in the next section.
If the plugin shows a notice about missing credentials or disabled fallback methods, open Settings from the notice and complete those fields.
How to use
Place a shortcode on any page to show the OTP form. Customers can enter either an email address or a mobile number. The plugin detects which one it is and sends the code on the right channel.
Add the login form
Create a page, for example “Login”, add a Shortcode block with the code below, and publish it.
[authyo_otp_login]Add the registration form
Create another page, for example “Register”, and add this shortcode.
[authyo_otp_register]The plugin also accepts
[authyo_otp_auth_login],[authyo_otp_auth_register]and[authyo_otp_auth](the login form). Use whichever you prefer.What customers do at login
The customer enters their email or mobile number and requests the code. They type the code they receive and are signed in. The customer must already have an account.
What customers do at registration
The customer fills in their details, requests the code, enters it, and the account is created.
What customers do at checkout
With Enable OTP Verification at Checkout on, the customer verifies their email address (and phone number, if a phone method is on) on the checkout page. The Place Order button unlocks only after verification. The verification is stored on the server for the session, so it cannot be skipped by editing the form.
Test your store
Switch on Testing Mode under Advanced and add a test email or phone number. For those entries OTP is skipped and verification always succeeds, so you can test without sending real codes. Turn it off before going live.
Settings reference
Every setting in the plugin, grouped by where you find it under WC OTP Auth → Settings. Default values are shown next to the setting name.
General: API credentials 3
- Authyo App ID
- The App ID of your Authyo application.
- Authyo Client ID
- The Client ID of your Authyo application.
- Authyo Client Secret
- The Client Secret of your Authyo application. It is masked after you save it.
General: basic settings 4
- Enable OTP on Login
- Require OTP verification when customers log in.
- Enable OTP on Registration
- Require OTP verification when customers register.
- Enable OTP Verification at Checkout
- Require customers to verify their email and phone before placing an order.
- Enable WooCommerce Order Notifications
- Send order status notifications by Email, SMS and WhatsApp. You set these up in Notification Flow.
General: OTP methods for login and register 4
- Send OTP via Email
- Deliver the code to the customer’s inbox.
- Send OTP via WhatsApp
- Deliver the code as a WhatsApp message.
- Send OTP via SMS
- Deliver the code as a text message.
- Send OTP via Voice Call
- Read the code aloud in an automated call. Available for India only.
General: checkout verification 2
These settings appear when checkout verification is on. The same four methods (Email, WhatsApp, SMS and Voice Call) can be chosen separately for checkout.
- OTP Methods for Checkout
- Choose which of Email, WhatsApp, SMS and Voice Call are offered at checkout.
- Checkout OTP Position Default: Billing Address only
- Where the phone OTP field appears on the checkout page: Billing Address only, Shipping Address only, or Both Billing & Shipping. The email OTP always appears in the billing section.
Advanced: OTP configuration 4
- OTP Length Default: 6
- Number of digits in the code. Allowed range: 4 to 8.
- OTP Expiry Time Default: 300
- How long a code stays valid, in seconds. Allowed range: 10 to 600.
- Maximum OTP Attempts Default: 5
- How many wrong codes a visitor can enter before being blocked. Allowed range: 1 to 20.
- Lockout Period Default: 15
- How long a visitor is blocked, in minutes, after reaching the maximum attempts. Allowed range: 1 to 1440. Use a low value while testing and 30 or more in production.
Advanced: priority and fallback 3
- Priority Method Default: WhatsApp
- The channel tried first for phone numbers: WhatsApp, SMS or Voice Call.
- Enable Fallback Method Default: On
- If the priority method fails, the plugin retries with SMS, then Voice Call, if those are enabled. Leaving this on is recommended.
- Allow Visitor Method Choice Default: Off
- Shows a selector before the code is sent so visitors can pick WhatsApp, SMS or Voice Call. It needs two or more phone methods enabled.
Advanced: testing mode 3
- Enable OTP bypass for testing
- Skip OTP verification for the test numbers and emails you list. Turn it off on a live store.
- Test Phone Numbers
- One number per line, with country code, for example
+1234567890. - Test Email Addresses
- One email address per line, for example
test@example.com.
Advanced: country codes 2
- Default Country
- The country preselected in the phone number field on the login and registration forms.
- Country Codes Cache
- The country list is fetched from the Authyo API and stored until you clear it. Use Clear & Refresh Country List to update it. The page shows how many countries are loaded and when they were last updated.
Advanced: phone validation 1
- Enable libphonenumber validation
- Uses Google’s phone number library to check numbers in real time on the login and registration forms. Invalid or mismatched numbers are flagged before the code is sent.
Shortcodes page 3
- Create Login Page
- Creates a published page with the login shortcode already inside, if it does not exist.
- Create Registration Page
- Creates a published page with the registration shortcode already inside, if it does not exist.
- Create All Missing Pages
- Creates whichever of the two pages is missing, in one click.
No settings match your search.
Set up order notifications
Order notifications send an automatic message when a WooCommerce order changes status. Switch on Enable WooCommerce Order Notifications in the General tab first. Then open WC OTP Auth → Notification Flow.
Add a flow
Click Add Flow on the left.
Choose a WooCommerce event
Select the order status that should trigger a message: Pending, Processing, On-hold, Completed, Cancelled, Refunded or Payment Failed.
Choose delivery channels
Pick Email, SMS, WhatsApp, or any combination.
Save the flow
Each event uses a ready-made template from your Authyo account. The flow card shows the template name, with a link to view the available templates.
Manage your flows
Each flow has an on and off switch, so you can pause it without deleting it. You can also edit or delete a flow, or use Edit All Flows and Delete All Flows to change them in bulk.
If an event’s template is not yet available, no message is sent for that event. A notification is also skipped when the customer has no email address or a valid phone number for the channel you chose.
Troubleshooting
Most problems have a quick fix. Find your issue below.
I see a notice about missing API credentials
The OTP does not arrive
Customers see “No account found with this mobile number” or “…with this email address”
Customers see “An account already exists with this mobile number” or “…email address”
Customers see “Too many OTP requests. Please try again in a few minutes”
Customers are blocked after wrong codes
Customers see “Invalid session. Please request a new OTP”
Customers see “Security check failed. Please try again”
The login or registration form does not appear
[authyo_otp_login] or [authyo_otp_register], that OTP is switched on for that form under Basic Settings, and that you saved the settings. A customer who is already signed in sees a message instead of the form.The Place Order button stays locked at checkout
Order notifications are not sent
The country list is empty or out of date
Frequently asked questions
Do I need an Authyo account?
Which channels can I use for OTP?
Can customers log in with a phone number?
Does it support international phone numbers?
Does OTP at checkout work with the Checkout Block?
Is it compatible with HPOS?
Can I keep password login as well?
What if a customer does not receive the code?
How long is an OTP valid?
Which order events can send notifications?
Can I test without sending real OTPs?
Still need help?
If you couldn’t find the answer in this guide, submit our support form and the Authyo team will get back to you.