# Authyo OTP for Contact Form 7

> Add email and phone OTP verification to your Contact Form 7 forms. Stop spam and fake leads by verifying visitors by SMS, WhatsApp, Email or Voice Call before they can submit.

Source: https://authyo.io/authyo-docs/authyo-otp-for-contact-form-7-plugin/

> Note: Voice Call OTP is currently available only in India.

## At a glance

- **What it does:** Adds one-time-password (OTP) verification for email addresses and phone numbers to Contact Form 7 forms.
- **OTP channels:** Email, SMS, WhatsApp and Voice Call (Voice Call is available in India only).
- **You need:** Contact Form 7, WordPress 5.5+, PHP 7.4+, and an Authyo account with an App ID, Client ID and Client Secret.
- **Settings location:** WordPress admin, under **Authyo OTP for CF7**.
- **Shortcodes:** `[authyo_email]`, `[authyo_phone]` and `[only_country_dropdown]`.
- **Get the plugin:** [WordPress.org: Authyo OTP for Contact Form 7](https://wordpress.org/plugins/authyo-otp-for-contact-form-7/)

## Overview

**Authyo OTP for Contact Form 7** adds a one-time-password check to your Contact Form 7 forms. Visitors verify their email address or phone number before the form can be submitted, so only genuine people reach your inbox.

OTPs are sent through your Authyo account by Email, SMS, WhatsApp or Voice Call. You turn OTP on for each form you want, then place a simple shortcode next to the field to verify.

_This plugin is an independent add-on for Contact Form 7, developed by Konceptwise Digital Media Pvt. Ltd. It is not developed by or affiliated with the Contact Form 7 authors._

- **Four OTP channels:** Verify by Email, SMS, WhatsApp or Voice Call. Voice Call is currently available in India only.
- **Fallback methods:** If the OTP does not arrive, visitors can retry with another channel after a short wait.
- **Per-form control:** Switch OTP on or off for each form, and set an optional redirect after submission.
- **Leads Manager:** Every submission is saved with its verification status and channel. Filter, search and export to CSV.
- **Google Sheets sync:** Send form entries to a Google Sheet, with your own column mapping.
- **WhatsApp Notify:** Get the details of every verified submission on your own WhatsApp number.
- **Country dropdown:** A searchable country selector with flags that adds the dial code to the phone number.
- **Consent checkbox:** Show a privacy policy and terms notice before the submit button.

## Requirements

- WordPress **5.5** or later and PHP **7.4** or later.
- **Contact Form 7** installed and activated. The plugin shows an error notice in the admin if it is missing.
- An **Authyo account** with an application. You will need its **App ID**, **Client ID** and **Client Secret**.
- Balance in your Authyo wallet to send OTPs.

## Installation

Install Contact Form 7 first, then the Authyo add-on.

### Step 1: Install and activate Contact Form 7
In WordPress go to **Plugins → Add New**, search for **Contact Form 7**, then click **Install Now** and **Activate**. Skip this step if it is already active.

### Step 2: Install Authyo OTP for Contact Form 7
Go to **Plugins → Add New**, search for **Authyo OTP for Contact Form 7**, then click **Install Now** and **Activate**. You can also upload the plugin ZIP using **Plugins → Add New → Upload Plugin**.

### Step 3: Open the plugin settings
A new **Authyo OTP for CF7** item (with a shield icon) appears in the WordPress admin menu. On first activation an interactive tour starts and walks you through the setup. You can restart it any time with the **Take a Tour** button on the settings page.

## Setup

Connect the plugin to your Authyo account, choose how OTPs are sent, and turn OTP on for your forms.

### Step 1: Create your Authyo account
Go to [app.authyo.io](https://app.authyo.io/account/welcome) and set up a free account. Enter your email, then verify it with the OTP you receive.

### Step 2: Create an application
In the Authyo dashboard, open the **Application** tab in the left menu and click **Create Application**. Add an application name, set your OTP options (such as expiry and length), then click **Create**.

### Step 3: Copy your credentials
Open [your applications](https://app.authyo.io/application/userapplication) and copy the **App ID**, **Client ID** and **Client Secret**.

### Step 4: Paste them into the General tab
In WordPress go to **Authyo OTP for CF7 → General** and paste the **App ID**, **Client ID** and **Client Secret**, then save. Use the eye icon to show or hide the secret.

_**Failsafe:** if your Authyo wallet balance runs out, the plugin automatically skips OTP verification so your forms keep working and visitors are not blocked._

### Step 5: Choose your OTP channels
Open the **Verification Methods** tab and switch on the channels you want: **Email**, **SMS**, **WhatsApp** and **Voice Call**. Phone channels need a phone field in your form. Voice Call is currently available only for India.

### Step 6: Turn on OTP for your forms
Open the **Form Integration** tab. Tick **Enable OTP** next to each Contact Form 7 form that should use verification. You can also add an optional **Redirect URL** to send visitors to a thank-you page after they submit.

_No forms listed? Create one first under **Contact → Contact Forms**, then return to the Form Integration tab._

## How to use

Add a shortcode next to the field you want to verify. The plugin finds the right field automatically: it looks for the email or phone field (type `email` or `tel`, or a name containing “email”, “phone” or “tel”) nearest to the shortcode.

### Step 1: Verify an email address
Edit your form under **Contact → Contact Forms** and add `[authyo_email]` right after the email field.

```
<label> Your Email
    [email* your-email] [authyo_email]
</label>

[submit "Submit"]
```

### Step 2: Verify a phone number
Add `[authyo_phone]` right after a phone (`tel`) field. The OTP is sent by SMS, WhatsApp or Voice Call, depending on your settings.

```
<label> Your Phone
    [tel* your-phone] [authyo_phone]
</label>

[submit "Submit"]
```

### Step 3: Verify both email and phone
Use both shortcodes in the same form. Visitors can choose which channels to verify.

```
<label> Email
    [email* your-email] [authyo_email]
</label>
<label> Phone
    [tel* your-phone] [authyo_phone]
</label>

[submit "Submit"]
```

### Step 4: Use WhatsApp as the main phone method
The same `[authyo_phone]` shortcode is used. Set **Primary Phone Method** to **WhatsApp** in the **Verification Methods** tab.

```
<label> WhatsApp
    [tel* your-phone] [authyo_phone]
</label>
```

### Step 5: Add only a country dropdown (no OTP)
Use `[only_country_dropdown]` (or `[only-country-dropdown]`) to show the searchable country selector on a phone field without OTP.

```
<label> Your Phone
    [tel* your-phone] [only-country-dropdown]
</label>

[submit "Submit"]
```

### Step 6: Save and test the form
Save the form, open the page it is on, enter an email or phone number and request the OTP. Type the code you receive. It is checked as soon as you finish entering it, then you can submit the form.

_If the shortcode is on a form where OTP is not enabled, the form shows a notice asking you to enable it under **Authyo OTP for CF7 → Form Integration**._

## Settings reference

Every setting in the plugin, grouped by the tab where you find it. Default values are shown next to the setting name.

### General

- **App ID**: The App ID of your Authyo application.
- **Client ID**: The Client ID of your Authyo application.
- **Client Secret**: The Client Secret of your Authyo application. It is hidden by default. Use the eye icon to show it.

### Verification Methods: channels and phone settings

- **Enable OTP Channels**: Switch on any of **Email**, **SMS**, **WhatsApp** and **Voice Call**. Voice Call is currently available only for India.
- **Primary Phone OTP Method** (Default: SMS): The method used first for phone OTPs: SMS, WhatsApp or Voice Call.
- **Allow Visitor Method Choice**: When on, visitors pick SMS, WhatsApp or Voice Call right after entering their number. When off, the primary method is used first and fallback options appear after the timer.
- **Fallback Timer (seconds)** (Default: 30): How long to wait before showing fallback options. It only applies when visitor method choice is off. Allowed range: 15 to 120.

### Verification Methods: OTP defaults

- **OTP Length** (Default: 6): Number of digits in the code. Allowed range: 4 to 8.
- **Expiry (minutes)** (Default: 5): How long a code stays valid. Allowed range: 1 to 10.
- **Resend Cooldown (seconds)** (Default: 30): How long visitors must wait before requesting another code. Allowed range: 10 to 120.
- **Max Resends** (Default: 3): How many times a visitor can request a new code. Allowed range: 1 to 5.

### Verification Methods: optional verification

By default verification is mandatory. These options add a **Skip Verification** button to the form.

- **Allow Skip for Email OTP**: Let visitors submit without verifying their email address.
- **Allow Skip for Phone OTP**: Let visitors submit without verifying their phone number.

### Verification Methods: country selector

- **Country Display Mode** (Default: All Countries): **All Countries** shows every country. **Selected Countries** shows only the ones you choose, for example the 4 or 5 where you operate.
- **Select Countries**: Search and add countries. Selected countries appear as tags that you can remove.
- **Country Selector Data**: The country list is cached from the Authyo API and refreshed automatically every 7 days. Use **Refresh Country List Now** to update it right away.

### Verification Methods: advanced phone validation

- **Enable Advanced Phone Validation (libphonenumber)** (Default: Off): Uses Google’s phone number library to check the number format, length and type for the selected country. Visitors see a live digit count (such as “3 / 10 digits”) and a warning for landline numbers. It adds about 150 KB to pages with phone fields. When off, a basic check is used with no extra page weight.

### Form Integration

- **Enable OTP**: Turn OTP verification on for this form.
- **GS Integration**: Send this form’s entries to Google Sheets (needs the Google Sheets tab set up).
- **Redirect URL (Optional)**: Where to send visitors after a successful submission, for example `https://example.com/thank-you`.

### Google Sheets

- **Enable Google Sheets Integration**: The master switch for the integration.
- **Google Apps Script Web App URL**: The Web App URL from your Google Apps Script deployment. See the Google Sheets guide below.
- **Form Field Mapping**: Match each Contact Form 7 field to the column heading you want in the sheet. Empty means the original field name is used.
- **Google Sheet Tab Name**: Optional tab name for this form. Empty means the form title is used.

### Leads Management

View and manage the submissions captured by Authyo OTP.

- **Filters**: Filter by **Status** (Verified, Skipped or Unverified), by **Form**, and by a **From** and **To** date.
- **Export CSV**: Download the leads for offline use.
- **Bulk delete**: Select leads and choose **Delete Selected**, or delete a single lead with its Delete link.
- **Columns**: ID, Date, Form Title, Lead Details, Status, Channel and WhatsApp (shows Sent or Failed for WhatsApp Notify).

### WhatsApp Notify

Get a WhatsApp message on your own number every time someone submits a verified form. It uses the Client ID and Client Secret from the General tab, so no other credentials are needed.

- **Enable WhatsApp Notifications**: The master switch. Turn it off to stop all WhatsApp notifications on every form.
- **Your WhatsApp Number**: Your number with the country code, for example `+91XXXXXXXXXX`. Submission details are sent here.
- **Send WhatsApp Notification (per form)**: Choose which forms trigger a notification.
- **Message limits**: Long text area values are trimmed to 500 characters, and the whole message is capped at 1,000 characters, to stay within WhatsApp template limits. File uploads are not sent.

### Consent

Show a notice before the submit button that visitors can tick to acknowledge your Privacy Policy and Terms of Use.

- **Enable Consent Checkbox**: The master switch. The checkbox is added to the forms you select.
- **Privacy Policy URL**: Used for the `{privacy_link}` placeholder in the consent text.
- **Terms of Use URL**: Used for the `{terms_link}` placeholder in the consent text.
- **Consent Text** (Default: By submitting this form, I agree to the {terms_link} and {privacy_link}.): Your wording. Use `{terms_link}` and `{privacy_link}` and they turn into links.
- **Show Consent Checkbox (per form)**: Choose which forms show the checkbox.

## Send entries to Google Sheets

Entries from your forms can be added to a Google Sheet. The plugin’s **GS Setup Guide** tab includes the script to paste in step 3.

### Step 1: Create a sheet
Create a new Google Sheet.

### Step 2: Open Apps Script
In the sheet, go to **Extensions → Apps Script**.

### Step 3: Paste the script
Delete any existing code and paste the script from **Authyo OTP for CF7 → GS Setup Guide** (use the **Copy to clipboard** button).

### Step 4: Deploy as a web app
Click **Deploy** and select a new deployment. Choose type **Web App**, set **Execute as** to **Me** and **Who has access** to **Anyone**. Click **Deploy**, authorize the script, and copy the **Web App URL**.

_If you edit the script later, use **Deploy → Manage Deployments**, click the pencil (Edit) icon and choose **New version**._

### Step 5: Paste the URL into the plugin
In WordPress open the **Google Sheets** tab, switch on **Enable Google Sheets Integration** and paste the Web App URL.

### Step 6: Choose your forms
In the **Form Integration** tab tick **GS Integration** for each form to sync. Back in the **Google Sheets** tab you can map fields to column headings and set a tab name.

## Troubleshooting

### I see “Contact Form 7 must be installed and activated”
The add-on needs Contact Form 7. Install and activate it from **Plugins → Add New**, then reload the page.

### My form says “Authyo OTP is not enabled for this form”
The shortcode is on a form where OTP is switched off. Go to **Authyo OTP for CF7 → Form Integration** and tick **Enable OTP** for that form.

### The OTP does not arrive
Check that your **App ID**, **Client ID** and **Client Secret** are correct, that the channel is switched on in **Verification Methods**, and that your Authyo wallet has balance. Make sure the phone number includes the right country. Visitors can also use the fallback options that appear after the fallback timer. Voice Call works only for India.

### Visitors see “Please verify OTP before submitting”
The visitor tried to submit before verifying. They need to enter the code first. If you prefer, switch on **Allow Skip for Email OTP** or **Allow Skip for Phone OTP** to add a Skip Verification button.

### Visitors see “Session expired. Send OTP again”
The code expired. By default a code is valid for 5 minutes. Ask the visitor to request a new one, or raise **Expiry (minutes)** in **Verification Methods** (up to 10).

### Visitors see “Too many attempts” or “Too many verification attempts”
As a safety measure, the plugin allows up to 5 OTP requests and 8 verification attempts within 10 minutes. The visitor should wait a few minutes and try again.

### Visitors see “Invalid phone number length”
The number does not match the selected country. Check the number and country. Turning on **Advanced Phone Validation** gives visitors a live digit count that makes the problem clear.

### Visitors see “Please select a country for your phone number”
The phone field needs a country from the dropdown before the OTP can be sent. Choose the country and try again.

### The OTP button or fields do not appear
Save the form after adding the shortcode, make sure OTP is enabled for it, and that the shortcode sits right after the email or phone field. Clear any page cache, and clear your browser cache.

### Forms show security or “nonce” errors with a caching plugin
The plugin tells caching plugins not to cache the page. If you still see errors, exclude the page that holds the form from page caching and from CDN caching.

### Forms submit without asking for an OTP
If your Authyo wallet balance is empty, the plugin skips OTP so forms keep working. Top up your Authyo wallet to turn verification back on.

### Entries are not reaching Google Sheets
Check that the Web App is deployed with **Who has access** set to **Anyone**, that the Web App URL is pasted in the **Google Sheets** tab, and that **GS Integration** is ticked for the form. After editing the script, deploy a **New version**.

### WhatsApp notification shows “Failed”
Check that your WhatsApp number is entered with the country code (for example `+91XXXXXXXXXX`), that your credentials are correct, and that your Authyo wallet has balance. The status appears in the **WhatsApp** column of **Leads Management**.

## Frequently asked questions

### Does this plugin require Contact Form 7?
Yes. It is an add-on for Contact Form 7 and needs it installed and activated.

### Which OTP methods are supported?
Email, SMS, WhatsApp and Voice Call. Voice Call is currently available only for India.

### Is an Authyo account required?
Yes. You need an Authyo account and an application to get your App ID, Client ID and Client Secret.

### Where do I find my App ID, Client ID and Client Secret?
In the Authyo dashboard, open [your applications](https://app.authyo.io/application/userapplication). Create an application if you do not have one yet.

### Can I use OTP on only some forms?
Yes. OTP is switched on or off for each form in the **Form Integration** tab.

### Does it work with popup forms?
Yes. It works with AJAX and popup forms.

### Does it support Indian phone numbers?
Yes. Indian numbers work with SMS, WhatsApp and Voice Call OTP.

### Can visitors skip verification?
Not by default. Verification is mandatory unless you switch on **Allow Skip for Email OTP** or **Allow Skip for Phone OTP**.

### Where can I see the submissions?
In **Authyo OTP for CF7 → Leads Management**. You can filter them and export to CSV.

### Will it slow down my site?
The optional Advanced Phone Validation adds about 150 KB on pages with phone fields, and it is off by default. With it off, the plugin uses a basic check with no extra page weight.

### Is this plugin made by the Contact Form 7 team?
No. It is developed by Konceptwise Digital Media Pvt. Ltd. and is not affiliated with the Contact Form 7 authors.

## Support

If this guide does not answer your question, submit the support form: https://authyo.io/support/