# Authyo OTP for Everest Forms

> Add email and phone OTP verification to your Everest Forms forms. Switch OTP on for a form, or add an Authyo field, and verify visitors by Email, SMS, WhatsApp or Voice Call before they can submit.

Source: https://authyo.io/authyo-docs/authyo-otp-for-everest-forms/

> Note: Voice Call OTP is currently available only in India.

## At a glance

- **What it does:** Adds one-time-password (OTP) verification for email addresses and phone numbers to Everest Forms forms.
- **OTP channels:** Email, SMS, WhatsApp and Voice Call (Voice Call is available in India only).
- **Two ways to add OTP:** Switch a form on in the **Forms** tab, so its normal Email and Phone fields are verified. Or add the **Authyo Email**, **Authyo Phone** or **Authyo Email / Phone** field from General Fields.
- **You need:** Everest Forms, WordPress 5.5+, PHP 7.4+, and an Authyo account with a Client ID and Client Secret.
- **Settings location:** WordPress admin, under **Authyo OTP**.
- **Safety net:** If your Authyo wallet balance runs out, forms keep accepting submissions without OTP and you get an email about it. This protection is on by default and can be turned off.
- **Get the plugin:** [WordPress.org: Authyo OTP for Everest Forms](https://wordpress.org/plugins/authyo-otp-for-everest-forms/)

## Overview

**Authyo OTP for Everest Forms** adds a one-time-password check to your Everest Forms forms. Visitors verify their email address or phone number before the form can be submitted, which reduces spam and fake submissions.

The quickest way is the **Forms** tab: switch OTP on for a form and its normal Email and Phone fields are verified automatically, with no change to the form itself. If you prefer, you can add the dedicated Authyo fields to a form instead.

_This plugin is an independent add-on for Everest Forms, developed by Konceptwise Digital Media Pvt. Ltd. It is not affiliated with, endorsed by or supported by Everest Forms._

- **Per-form switch:** Turn OTP on for the forms you choose. Their existing Email and Phone fields stay exactly as they are, and are verified automatically.
- **Dedicated Authyo fields:** Add Authyo Email, Authyo Phone or the smart Authyo Email / Phone field from General Fields.
- **Four OTP channels:** Email, SMS, WhatsApp and Voice Call. Voice Call is currently available in India only.
- **Send a test OTP:** Send one real code to yourself to confirm your keys and channels work.
- **Guided setup:** A setup walkthrough and a progress meter show what is left to do.
- **Country selector:** Show all countries or only the ones you serve, and preselect a default country.
- **Abuse limits:** Built-in limits on how often codes can be sent protect your Authyo balance.
- **Fail-safe protection:** If your balance runs out, forms keep working and you are emailed once a day. You can switch this off to block submissions instead.

## Requirements

- WordPress **5.5** or later and PHP **7.4** or later.
- **Everest Forms** installed and activated.
- An **Authyo account** with an application. You will need its **Client ID** and **Client Secret**.
- Balance in your Authyo wallet to send OTPs.

## Installation

Install Everest Forms first, then the Authyo add-on.

### Step 1: Install and activate Everest Forms
Go to **Plugins → Add New**, search for **Everest Forms**, then click **Install Now** and **Activate**. Skip this step if it is already active.

### Step 2: Install Authyo OTP for Everest Forms
Go to **Plugins → Add New**, search for **Authyo OTP for Everest Forms**, then click **Install Now** and **Activate**. You can also upload the plugin ZIP using **Plugins → Add New → Upload Plugin**.

### Step 3: Open the plugin settings
A new **Authyo OTP** item appears in the WordPress admin menu. The settings page has five tabs: **General**, **Verification Methods**, **Forms**, **How to Use** and **Support**. At the top, a status shows **OTP is live**, **OTP is switched off** or **Setup needed**.

## Setup

Connect the plugin to your Authyo account and choose how OTPs are sent. You can use **Setup Authyo** for a guided walkthrough, or fill in the tabs yourself.

### Step 1: Create your Authyo account
Go to [app.authyo.io](https://app.authyo.io/account/welcome) and create a free account.

### Step 2: Copy your credentials
Open [your applications](https://app.authyo.io/application/userapplication) in the Authyo dashboard and copy the **Client ID** and **Client Secret**. Create an application first if you do not have one.

### Step 3: Paste them into the General tab
In WordPress go to **Authyo OTP → General**. Under **API Credentials**, enter the **Client ID** and **Client Secret**, then click **Save Changes**. Until you do this, forms submit without verification.

### Step 4: Choose your verification channels
Open the **Verification Methods** tab. Under **Verification Channels**, switch on **Email**, **SMS**, **WhatsApp** and **Voice Call** as needed, and pick a **Primary Channel (Phone)**. Voice Call is currently available only for India. If no phone channel is on, phone fields are not verified and do not block a form.

### Step 5: Send a test OTP
On the same tab, use **Send a test OTP**. Choose **Email OTP** or a phone channel, enter your own email address or phone number, and click **Send test OTP**. Type the code you receive and click **Verify code**. This uses one OTP from your Authyo balance and confirms everything works.

_Next, turn OTP on for your forms in the **Forms** tab (see the next section)._

## How to use

There are two ways to add OTP to a form. Use either one, or both on different forms.

### Step 1: Option 1: switch a form on in the Forms tab
Open **Authyo OTP → Forms**. Switch on each form you want to protect. On those forms, the normal Email and Phone fields must be verified with a one-time code before the form can be submitted. Use **Turn all on** or **Turn all off** to change every form at once, and the search box to find a form. Forms you leave off are not affected.

_The form’s own fields are never replaced. Their IDs, names and stored entries stay exactly as they were, and the OTP controls are added next to them. A form that already contains an Authyo field is always verified, whatever its switch says. A form with no Email or Phone field is marked so you can see there is nothing to verify._

### Step 2: Option 2: add an Authyo field
Edit a form with **Everest Forms → All Forms**. In the **General Fields** section, add **Authyo Email** to verify an email address, **Authyo Phone** to verify a phone number, or **Authyo Email / Phone**, a smart field that accepts either one.

### Step 3: Save and test
Save the form and open it on your site. Enter an email address or phone number, request the code, enter it and submit. If a visitor submits without verifying, the form says “Verification is required. Please verify before submitting”.

_Forms that existed before version 1.0.4 are not affected until you switch them on, because the per-form switch is off by default._

## Settings reference

Every setting in the plugin, grouped by the tab where you find it under **Authyo OTP**.

### General: API credentials

- **Client ID**: The Client ID of your Authyo application.
- **Client Secret**: The Client Secret of your Authyo application. After saving it shows **Saved**. Leave it blank to keep the saved value.
- **Remove my saved keys when I save**: Deletes your stored credentials. OTP stops working until you add new ones.
- **Let Authyo know when this plugin is activated or deactivated (optional)**: Never ticked by default. When ticked, and a Client ID is saved, the plugin tells Authyo when it is activated or deactivated: the event, your site address, plugin, WordPress and PHP versions, your Client ID and the time. Your Client Secret, form entries and visitor data are never sent.

### General: failsafe protection

- **Let forms submit without OTP when my wallet is empty** (Default: On): When on, forms keep accepting submissions if your Authyo wallet runs out, so you do not lose leads, and you are emailed once a day. Turn it off to block submissions instead.

### Verification Methods: channels

- **Email, SMS, WhatsApp, Voice Call**: Switch on the channels you want to offer. Voice Call is available only in India.
- **Primary Channel (Phone)**: The channel used first for phone numbers: SMS, WhatsApp or Voice Call. Fallback options appear after 1 minute.
- **Allow visitor to choose method**: When on, visitors see a button for each enabled channel straight away, instead of a single “Send OTP” button.
- **Strict Validation (Multi-page Forms)**: When on, visitors cannot move to the next page of a multi-step form until the Authyo fields on the current page are verified.
- **Send a test OTP**: Sends one real code, using your saved keys, to your own email address or phone number. It uses one OTP from your balance.

### Verification Methods: optional verification

By default verification is mandatory. These options add a **Skip Verification** button to the form.

- **Allow Skip for Email OTP**: Let visitors submit without verifying their email address.
- **Allow Skip for Phone OTP**: Let visitors submit without verifying their phone number.

### Verification Methods: country selection

- **Select All Countries / Select Specific Countries**: Show every country in the phone field dropdown, or only the ones you choose.
- **Default Country**: The country preselected in the phone field. Visitors can still change it.
- **Country List Cache**: The country list is cached. Use **Refresh Cache** to fetch the latest list. If Authyo cannot be reached, the list you already have keeps working.

### Verification Methods: OTP defaults

- **OTP Length** (Default: 6): Number of digits in the code. Allowed range: 4 to 8.
- **Expiry (minutes)** (Default: 5): How long a code stays valid. Allowed range: 1 to 10.
- **Resend Cooldown (seconds)** (Default: 60): The wait before another code can be sent to the same contact. Allowed range: 10 to 120.
- **Max Resends** (Default: 3): How many times a code can be re-sent to the same contact within 10 minutes. Allowed range: 1 to 5.

### Forms

- **Form switch** (Default: Off): Turn OTP on for a form. Its normal Email and Phone fields must then be verified before submit.
- **Turn all on / Turn all off**: Change every form at once.
- **Search forms**: Find a form by name. The tab also shows how many forms are on.

### Form fields (in the Everest Forms builder)

- **Authyo Email**: A field that verifies an email address with an OTP.
- **Authyo Phone**: A field that verifies a phone number by SMS, WhatsApp or Voice Call, with a country selector.
- **Authyo Email / Phone**: A smart field that accepts either an email address or a phone number.

## How code sending is limited

To protect your Authyo balance from abuse, the plugin limits how often codes can be sent. These limits are built in.

### Step 1: Per contact
A second code to the same email or phone number must wait for the **Resend Cooldown** (default 60 seconds). A contact can receive up to **Max Resends + 1** codes in 10 minutes (default 4), and up to 10 codes a day from anyone.

### Step 2: Per visitor
One visitor can request up to 30 codes every 10 minutes and 150 codes a day, to any contact.

### Step 3: Whole site
The site as a whole can send up to 500 codes an hour.

### Step 4: Behind Cloudflare or a load balancer
The limits are counted per visitor IP address. If your host does not pass on the visitor’s real IP address, every visitor looks the same and shares one limit, so people see “Too many attempts”. Ask your host to restore the real IP, or return it with the `authyo_evf_client_ip` filter.

## Troubleshooting

### The status says “Setup needed”
Add your **Client ID** and **Client Secret** in the General tab, or use **Setup Authyo**. Until then forms submit without verification.

### The status says “OTP is switched off”
Your keys are saved but verification is turned off. Open **Setup Authyo** to switch it back on.

### I see “Your saved Authyo keys could not be read”
The WordPress security keys (salts) in `wp-config.php` were changed after your keys were saved. Enter your **Client ID** and **Client Secret** again and save.

### I see a message about OpenSSL
The OpenSSL PHP extension is not available on your server, so saved keys are only encoded and not encrypted. Ask your host to enable OpenSSL.

### I see “Your Authyo balance is low”
OTP was skipped recently so your forms kept working. Top up your Authyo wallet to keep verifying visitors.

### The OTP does not arrive
Use **Send a test OTP** to check your keys and channels. Check that the channel is switched on, that your Authyo wallet has balance, and that the email address or phone number is valid. Voice Call works only for India.

### The form submits without asking for an OTP
Check that OTP is switched on for that form in the **Forms** tab (or that it has an Authyo field), that your keys are set, and that your wallet has balance. With the failsafe on, an empty wallet lets forms submit without OTP. Phone fields are also not verified if no phone channel is switched on.

### Visitors see “Too many attempts” or “Too many verification attempts”
The visitor reached a limit. They should wait a few minutes. If many visitors see it, your site may be behind Cloudflare or a load balancer that hides real IP addresses. See “How code sending is limited”.

### Visitors see “Session expired. Send OTP again”
The code timed out. By default a code is valid for 5 minutes. Ask the visitor to request a new one, or raise **Expiry (minutes)** (up to 10).

### Visitors see “Verification is required. Please verify before submitting”
The visitor must verify before submitting. If you prefer, switch on **Allow Skip for Email OTP** or **Allow Skip for Phone OTP**.

### Visitors see “The value entered does not match the one that was verified”
The visitor changed their email or phone after verifying it. They need to verify the new value.

### Visitors see “Voice Call in the selected country is not available”
Voice Call works only for India. Ask the visitor to choose SMS or WhatsApp, or switch off Voice Call.

### A multi-page form will not move to the next page
**Strict Validation (Multi-page Forms)** is on, so the Authyo fields on the current page must be verified first.

## Frequently asked questions

### Does this plugin require Everest Forms?
Yes. It is an extension for Everest Forms and needs it installed and activated.

### Which OTP methods are supported?
Email, SMS, WhatsApp and Voice Call. Voice Call is currently available only for India.

### Is an Authyo account required?
Yes. You need an Authyo account and an application to get your Client ID and Client Secret.

### Do I have to change my forms to use OTP?
No. Switch a form on in the **Forms** tab and its existing Email and Phone fields are verified automatically. You can also add the dedicated Authyo fields if you prefer.

### Will it change my existing form fields or entries?
No. The form’s own fields are never replaced. Their IDs, names and stored entries stay the same.

### Are my existing forms affected when I install it?
No. The per-form switch is off by default, so forms stay as they are until you turn them on.

### What happens if my Authyo balance runs out?
With the failsafe on (the default), forms keep accepting submissions without OTP so you do not lose leads, and you are emailed once a day. Turn the setting off to block submissions instead.

### Can I test it without a real visitor?
Yes. Use **Send a test OTP** on the Verification Methods tab. It sends one real code to your own email or phone and uses one OTP from your balance.

### Is any data sent to Authyo about my site?
Only if you tick the optional activation notice box. Even then, only the event, site address, versions, Client ID and time are sent.

### Is this plugin made by the Everest Forms team?
No. It is developed by Konceptwise Digital Media Pvt. Ltd. and is not affiliated with, endorsed by or supported by Everest Forms.

## Support

If this guide does not answer your question, submit the support form: https://authyo.io/support/