# Authyo Authentication and Notification for WooCommerce

> Let customers log in, register and check out with a one-time password sent to their email or phone, and keep them updated with automatic WooCommerce order notifications by Email, SMS and WhatsApp.

Source: https://authyo.io/authyo-docs/authyo-otp-authentication-for-woocommerce/

> Note: Voice Call OTP is currently available only in India.

## At a glance

- **What it does:** Adds OTP login, registration and checkout verification to WooCommerce, and sends order status notifications to customers.
- **OTP channels:** Email, SMS, WhatsApp and Voice Call (Voice Call is available in India only).
- **Notification channels:** Email, SMS and WhatsApp.
- **You need:** WooCommerce 5.0+, WordPress 5.0+, PHP 7.4+, and an Authyo account with an App ID, Client ID and Client Secret.
- **Settings location:** WordPress admin, under **WC OTP Auth** (Settings, Shortcodes, Notification Flow and Documentation).
- **Shortcodes:** `[authyo_otp_login]` and `[authyo_otp_register]`.
- **Compatibility:** Works with WooCommerce High-Performance Order Storage (HPOS) and the Cart and Checkout Blocks.
- **Get the plugin:** [WordPress.org: Authyo Authentication and Notification for WooCommerce](https://wordpress.org/plugins/authyo-otp-authentication-for-woocommerce/)

## Overview

**Authyo Authentication and Notification for WooCommerce** lets customers log in, register and check out with a one-time password (OTP) sent to their email or phone. There is no password to remember or reset. The plugin also sends automatic order status notifications.

OTPs and notifications are delivered through your Authyo account. You choose which channels to turn on, which one is tried first, and whether to fall back to another channel if delivery fails.

- **OTP login and registration:** Add a login or registration form to any page with a shortcode. Customers sign in or sign up with a code sent to their email or phone.
- **Checkout verification:** Ask customers to verify their email and phone before they can place an order. Works with the classic checkout and the Checkout Block.
- **Order notifications:** Send Email, SMS or WhatsApp messages automatically when an order changes status.
- **Four OTP channels:** Email, SMS, WhatsApp and Voice Call. Voice Call is currently available for India only.
- **Priority and fallback:** Choose which channel is tried first, and fall back automatically if delivery fails.
- **Country selector:** A country code selector on phone fields, with a default country you can preselect.
- **Security controls:** Limits on failed attempts, a lockout period and rate limiting protect against abuse.
- **Testing mode:** Skip OTP for test emails and phone numbers so you can try your store without sending real codes.

## Requirements

- WordPress **5.0** or later and PHP **7.4** or later.
- **WooCommerce 5.0** or later installed and activated.
- An **Authyo account** with an application. You will need its **App ID**, **Client ID** and **Client Secret**.
- Credits in your Authyo account to send OTPs and notifications.

## Installation

Install WooCommerce first, then the Authyo plugin.

### Step 1: Install and activate WooCommerce
Go to **Plugins → Add New**, search for **WooCommerce**, then click **Install Now** and **Activate**. Skip this step if your store is already running.

### Step 2: Install the Authyo plugin
Go to **Plugins → Add New**, search for **Authyo Authentication and Notification for WooCommerce**, then click **Install Now** and **Activate**. You can also upload the plugin ZIP using **Plugins → Add New → Upload Plugin**.

### Step 3: Open the plugin menu
A **WC OTP Auth** item (with a lock icon) appears in the WordPress admin menu. It has four pages: **Settings**, **Shortcodes**, **Notification Flow** and **Documentation**.

## Setup

Connect the plugin to your Authyo account, choose where OTP is used, and create your login and registration pages.

### Step 1: Create your Authyo account
Go to [app.authyo.io](https://app.authyo.io/account/welcome) and create a free account.

### Step 2: Copy your credentials
Open [your applications](https://app.authyo.io/application/userapplication) in the Authyo dashboard. The **App ID**, **Client ID** and **Client Secret** are listed together. Create an application first if you do not have one.

### Step 3: Paste them into the General tab
In WordPress go to **WC OTP Auth → Settings → General**. Under **API Credentials**, fill in **Authyo App ID**, **Authyo Client ID** and **Authyo Client Secret**, then save. Each field shows **Configured** or **Not set**, and the secret is masked.

_The **Setup Checklist** at the top of the settings page shows what is still missing: credentials, at least one delivery method, OTP turned on for login or registration, and the login and registration pages._

### Step 4: Choose where OTP is used
Under **Basic Settings**, switch on what you need: **Enable OTP on Login**, **Enable OTP on Registration**, **Enable OTP Verification at Checkout** and **Enable WooCommerce Order Notifications**.

### Step 5: Choose your delivery methods
Under **OTP Methods for Login & Register**, switch on **Email**, **WhatsApp**, **SMS** and **Voice Call**. If you use checkout verification, choose the methods for it under **OTP Methods for Checkout**. Voice Call is currently available for India only, so turn on fallback for other countries.

### Step 6: Create your login and registration pages
Go to **WC OTP Auth → Shortcodes** and click **Create All Missing Pages**. This creates a Login page and a Registration page with the right shortcode already inside. Or create the pages yourself, as shown in the next section.

_If the plugin shows a notice about missing credentials or disabled fallback methods, open **Settings** from the notice and complete those fields._

## How to use

Place a shortcode on any page to show the OTP form. Customers can enter either an email address or a mobile number. The plugin detects which one it is and sends the code on the right channel.

### Step 1: Add the login form
Create a page, for example “Login”, add a Shortcode block with the code below, and publish it.

```
[authyo_otp_login]
```

### Step 2: Add the registration form
Create another page, for example “Register”, and add this shortcode.

```
[authyo_otp_register]
```

_The plugin also accepts `[authyo_otp_auth_login]`, `[authyo_otp_auth_register]` and `[authyo_otp_auth]` (the login form). Use whichever you prefer._

### Step 3: What customers do at login
The customer enters their email or mobile number and requests the code. They type the code they receive and are signed in. The customer must already have an account.

### Step 4: What customers do at registration
The customer fills in their details, requests the code, enters it, and the account is created.

### Step 5: What customers do at checkout
With **Enable OTP Verification at Checkout** on, the customer verifies their email address (and phone number, if a phone method is on) on the checkout page. The **Place Order** button unlocks only after verification. The verification is stored on the server for the session, so it cannot be skipped by editing the form.

### Step 6: Test your store
Switch on **Testing Mode** under **Advanced** and add a test email or phone number. For those entries OTP is skipped and verification always succeeds, so you can test without sending real codes. Turn it off before going live.

## Settings reference

Every setting in the plugin, grouped by where you find it under **WC OTP Auth → Settings**. Default values are shown next to the setting name.

### General: API credentials

- **Authyo App ID**: The App ID of your Authyo application.
- **Authyo Client ID**: The Client ID of your Authyo application.
- **Authyo Client Secret**: The Client Secret of your Authyo application. It is masked after you save it.

### General: basic settings

- **Enable OTP on Login**: Require OTP verification when customers log in.
- **Enable OTP on Registration**: Require OTP verification when customers register.
- **Enable OTP Verification at Checkout**: Require customers to verify their email and phone before placing an order.
- **Enable WooCommerce Order Notifications**: Send order status notifications by Email, SMS and WhatsApp. You set these up in **Notification Flow**.

### General: OTP methods for login and register

- **Send OTP via Email**: Deliver the code to the customer’s inbox.
- **Send OTP via WhatsApp**: Deliver the code as a WhatsApp message.
- **Send OTP via SMS**: Deliver the code as a text message.
- **Send OTP via Voice Call**: Read the code aloud in an automated call. Available for India only.

### General: checkout verification

These settings appear when checkout verification is on. The same four methods (Email, WhatsApp, SMS and Voice Call) can be chosen separately for checkout.

- **OTP Methods for Checkout**: Choose which of Email, WhatsApp, SMS and Voice Call are offered at checkout.
- **Checkout OTP Position** (Default: Billing Address only): Where the phone OTP field appears on the checkout page: **Billing Address only**, **Shipping Address only**, or **Both Billing & Shipping**. The email OTP always appears in the billing section.

### Advanced: OTP configuration

- **OTP Length** (Default: 6): Number of digits in the code. Allowed range: 4 to 8.
- **OTP Expiry Time** (Default: 300): How long a code stays valid, in seconds. Allowed range: 10 to 600.
- **Maximum OTP Attempts** (Default: 5): How many wrong codes a visitor can enter before being blocked. Allowed range: 1 to 20.
- **Lockout Period** (Default: 15): How long a visitor is blocked, in minutes, after reaching the maximum attempts. Allowed range: 1 to 1440. Use a low value while testing and 30 or more in production.

### Advanced: priority and fallback

- **Priority Method** (Default: WhatsApp): The channel tried first for phone numbers: WhatsApp, SMS or Voice Call.
- **Enable Fallback Method** (Default: On): If the priority method fails, the plugin retries with SMS, then Voice Call, if those are enabled. Leaving this on is recommended.
- **Allow Visitor Method Choice** (Default: Off): Shows a selector before the code is sent so visitors can pick WhatsApp, SMS or Voice Call. It needs two or more phone methods enabled.

### Advanced: testing mode

- **Enable OTP bypass for testing**: Skip OTP verification for the test numbers and emails you list. Turn it off on a live store.
- **Test Phone Numbers**: One number per line, with country code, for example `+1234567890`.
- **Test Email Addresses**: One email address per line, for example `test@example.com`.

### Advanced: country codes

- **Default Country**: The country preselected in the phone number field on the login and registration forms.
- **Country Codes Cache**: The country list is fetched from the Authyo API and stored until you clear it. Use **Clear & Refresh Country List** to update it. The page shows how many countries are loaded and when they were last updated.

### Advanced: phone validation

- **Enable libphonenumber validation**: Uses Google’s phone number library to check numbers in real time on the login and registration forms. Invalid or mismatched numbers are flagged before the code is sent.

### Shortcodes page

- **Create Login Page**: Creates a published page with the login shortcode already inside, if it does not exist.
- **Create Registration Page**: Creates a published page with the registration shortcode already inside, if it does not exist.
- **Create All Missing Pages**: Creates whichever of the two pages is missing, in one click.

## Set up order notifications

Order notifications send an automatic message when a WooCommerce order changes status. Switch on **Enable WooCommerce Order Notifications** in the General tab first. Then open **WC OTP Auth → Notification Flow**.

### Step 1: Add a flow
Click **Add Flow** on the left.

### Step 2: Choose a WooCommerce event
Select the order status that should trigger a message: **Pending**, **Processing**, **On-hold**, **Completed**, **Cancelled**, **Refunded** or **Payment Failed**.

### Step 3: Choose delivery channels
Pick **Email**, **SMS**, **WhatsApp**, or any combination.

### Step 4: Save the flow
Each event uses a ready-made template from your Authyo account. The flow card shows the template name, with a link to view the available templates.

### Step 5: Manage your flows
Each flow has an on and off switch, so you can pause it without deleting it. You can also edit or delete a flow, or use **Edit All Flows** and **Delete All Flows** to change them in bulk.

_If an event’s template is not yet available, no message is sent for that event. A notification is also skipped when the customer has no email address or a valid phone number for the channel you chose._

## Troubleshooting

### I see a notice about missing API credentials
Open **WC OTP Auth → Settings → General** and fill in the **App ID**, **Client ID** and **Client Secret** from your Authyo dashboard. The Setup Checklist shows what is left to do.

### The OTP does not arrive
Check that your credentials are correct, that the channel is switched on in **OTP Methods**, that your Authyo account has credits, and that the mobile number includes the correct country. Turn on **Enable Fallback Method** so another channel is tried automatically. Voice Call works only for India.

### Customers see “No account found with this mobile number” or “…with this email address”
Login needs an existing account. The email or mobile number must match a registered customer. New customers should use the registration form.

### Customers see “An account already exists with this mobile number” or “…email address”
The details are already registered. Ask the customer to use the login form instead.

### Customers see “Too many OTP requests. Please try again in a few minutes”
The plugin allows up to 5 OTP requests per 10 minutes for each email and IP address. The customer should wait a few minutes and try again.

### Customers are blocked after wrong codes
After the **Maximum OTP Attempts** is reached, the customer is locked out for the **Lockout Period**, then can try again. Both are set under **Advanced**. The defaults are 5 attempts and 15 minutes.

### Customers see “Invalid session. Please request a new OTP”
The code expired or the session was lost. The default expiry is 300 seconds. Ask the customer to request a new code, or raise **OTP Expiry Time** (up to 600 seconds).

### Customers see “Security check failed. Please try again”
This is usually a cached page. Clear your page cache and CDN cache, then reload the page. Exclude the login, registration and checkout pages from caching.

### The login or registration form does not appear
Check that the page contains `[authyo_otp_login]` or `[authyo_otp_register]`, that OTP is switched on for that form under **Basic Settings**, and that you saved the settings. A customer who is already signed in sees a message instead of the form.

### The Place Order button stays locked at checkout
The customer must verify the OTP first. Check that **Enable OTP Verification at Checkout** is on and that at least one method is enabled for checkout. If it is a test order, add the email or number to **Testing Mode**.

### Order notifications are not sent
Check that **Enable WooCommerce Order Notifications** is on, that a flow exists for the order status with the flow switched on, and that the customer’s email or phone number is valid. Events whose template is not yet available are skipped.

### The country list is empty or out of date
Go to **Advanced → Country Codes Cache** and click **Clear & Refresh Country List**.

## Frequently asked questions

### Do I need an Authyo account?
Yes. The plugin sends OTPs and notifications through the Authyo API. Create an account, then copy your App ID, Client ID and Client Secret into the plugin settings.

### Which channels can I use for OTP?
Email, SMS, WhatsApp and Voice Call. Voice Call is currently available for India only. You can turn on one or several channels, set a priority channel and enable automatic fallback.

### Can customers log in with a phone number?
Yes. Customers can enter either an email address or a mobile number, and the plugin sends the code on the right channel.

### Does it support international phone numbers?
Yes. Phone fields include a country code selector for countries worldwide, and you can preselect a default country.

### Does OTP at checkout work with the Checkout Block?
Yes. It works with both the classic WooCommerce checkout and the Checkout Block.

### Is it compatible with HPOS?
Yes. The plugin is compatible with WooCommerce High-Performance Order Storage.

### Can I keep password login as well?
Yes. The OTP form appears only on pages where you place the shortcode, so the default WooCommerce login remains available alongside it.

### What if a customer does not receive the code?
If fallback is on, the plugin tries another channel automatically. Customers also see a “Try another method” option in the form.

### How long is an OTP valid?
By default 300 seconds (5 minutes). You can set it between 10 and 600 seconds under **Advanced → OTP Configuration**.

### Which order events can send notifications?
Pending, Processing, On-hold, Completed, Cancelled, Refunded and Payment Failed, by Email, SMS and WhatsApp. Each event can use one or several channels.

### Can I test without sending real OTPs?
Yes. Switch on **Testing Mode** under **Advanced** and list your test emails and phone numbers. OTP is skipped for those entries.

## Support

If this guide does not answer your question, submit the support form: https://authyo.io/support/