=== WALoops OTP Login ===
Contributors: bhagirath25
Tags: whatsapp, otp, login, two factor, woocommerce
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add WhatsApp OTP login & registration to WordPress in minutes. 100 free OTPs/month, no credit card required.

== Description ==

**Add WhatsApp OTP login to WordPress in 2 minutes.**

A password-free login and registration option, delivered over WhatsApp — works alongside your existing login form, on any theme, with or without WooCommerce. No password to remember, no password to reset, no password to leak.

**Free forever — 100 OTPs/month**

Get a free API key by creating a WALoops account from the plugin's settings page (no credit card) and start sending real WhatsApp OTPs from WALoops' shared WhatsApp number immediately.

= Everything you need, nothing you don't =

* **Adds, never replaces** — sits alongside your normal login and registration forms as an extra option, never in place of them
* **3 ready-made designs** — Modern, Minimal, and Card form styles, pick one in Settings, no CSS required
* **Works in minutes** — no Meta Developer account needed on the Free or Introduction (shared-number) plans
* **Bring your own number** — Introduction and Starter Ecommerce plans let you send from your own WhatsApp Business number
* **WooCommerce checkout** — offer WhatsApp OTP verification right at checkout on the Starter Ecommerce plan
* **Shortcode-friendly** — place the form anywhere with `[wa_otp_login]`, or drag it on as a native **Elementor** widget or **WPBakery Page Builder** element
* **Spam-proof your other forms** — a "WhatsApp OTP Verify" field/tag for **Contact Form 7**, **WPForms**, **Gravity Forms**, and **Formidable Forms** blocks submission until the visitor's number checks out (experimental for Ninja Forms — test before relying on it)
* **Goes global** — a country dial-code selector on every phone field, pre-filled from the visitor's browser language and always changeable
* Fully translatable (text domain: `waloops-otp-login`)

= Simple, WordPress-friendly pricing =

Start free. Upgrade only when you actually need more volume or your own number.

* **Free — $0/month.** Everything you need to try WhatsApp OTP login on a live site: 100 OTPs/month from our shared number, all 3 form styles, login/register/shortcode placement.
* **Introduction — $5/month.** For sites outgrowing the free quota: 1,000 OTPs/month, use our shared number or connect your own, switch any time.
* **Starter Ecommerce — $9.99/month.** For high-traffic and WooCommerce sites: unlimited OTPs on your own connected WhatsApp Business number, checkout verification, and priority support.

= How it works =

1. Install and activate the plugin.
2. Go to **Settings > WhatsApp OTP Login** and click **Create a free WALoops account** — you'll land straight on your API key. Paste it into the field on this same settings page.
3. Pick where the OTP option should appear (login page, registration page, WooCommerce checkout) — or drop the `[wa_otp_login]` shortcode anywhere.
4. Done. Visitors can now log in or register with just their WhatsApp number.
5. To verify a phone number on your own Contact Form 7, WPForms, Gravity Forms, or Formidable Forms form instead: add a `[wa_otp_verify your-phone]` tag in the CF7 form editor, or drag/add the "WhatsApp OTP Verify" field into the other three builders — no extra setup needed once your API key is saved.
6. Using Elementor or WPBakery Page Builder? Drag the "WhatsApp OTP Login" widget/element onto any page instead of using the shortcode.

== External services ==

This plugin connects to WALoops' WhatsApp OTP service (**https://app.waloops.com/**) to deliver one-time-password messages over WhatsApp. This connection is required for the plugin to work — there's no way to send a WhatsApp message without it.

What is sent, and when:

* **Creating a free WALoops account**: clicking "Create a free WALoops account" takes you to app.waloops.com to register or log in. Nothing is sent from this plugin at that point — once you're logged in there, your API key is generated for you to paste back into this settings page.
* **When a visitor requests a verification code** (login, registration, checkout, or a Contact Form 7 / WPForms field): their phone number is sent to WALoops so it can send them a WhatsApp message containing the code.
* **When a visitor submits a code**: their phone number and the code they entered are sent to WALoops to be checked.
* **On the settings page**: your account's monthly usage is fetched from WALoops so it can be shown to you. If you choose to connect your own WhatsApp Business number, your Meta access token and phone number ID are also sent to WALoops, to verify and store for your account.

No data is sent to any other third party. See WALoops' [Terms of Service](https://waloops.com/terms) and [Privacy Policy](https://waloops.com/privacy-policy).

== Frequently Asked Questions ==

= Do I need a Meta/Facebook Developer account? =

No — not on the Free or Introduction plans, where you can send from WALoops' shared WhatsApp number. Connecting your own number (optional on Introduction, required on Starter Ecommerce) does require your own WhatsApp Business Cloud API app.

= What happens when I run out of free OTPs for the month? =

Sends are blocked with a clear "monthly limit reached" message until the next calendar month starts, or until you upgrade.

= Does this replace my normal login form? =

No. It's added as an extra option alongside your existing username/password login and registration forms.

= Can I customize the WhatsApp message text? =

WhatsApp only allows pre-approved wording for one-time-passcode (Authentication-category) messages — you can't write fully custom copy. Right now the message is "{code} is your verification code. For your security, do not share this code." More variants (with an expiry line, code-only) will appear as an option once they're approved with Meta.

= Is my visitors' data safe? =

Phone numbers and OTP codes are transmitted over HTTPS and are used solely to deliver and verify the one-time password. See the "External services" section above for exactly what's sent and when.

= Does this work with international phone numbers? =

Yes. Every phone field has a country dial-code selector (pre-filled from the visitor's browser language, always changeable) — there's no restriction to a specific country, as long as WhatsApp is reachable at that number.

= How does the form-builder verification work? =

Add the `[wa_otp_verify your-phone]` tag (CF7) or the "WhatsApp OTP Verify" field (WPForms, Gravity Forms, Formidable Forms) to your form. A visitor enters their WhatsApp number, receives a code, and enters it — the form can't be submitted until that check passes. No phone number is stored by this plugin for this feature; verification is a signed, short-lived token checked again on submission, the same way a nonce works.

= Which form builders are supported? =

Contact Form 7, WPForms, Gravity Forms, and Formidable Forms are fully supported. Ninja Forms support is experimental — please test it on your own site before relying on it. Elementor Pro Forms, Fluent Forms, and SureForms aren't supported yet.

== Screenshots ==

1. Settings page — usage, API key, message style, and where the OTP form shows.
2. The "Modern" front-end OTP form on a login page.
3. The "Card" front-end OTP form style.
4. Usage dashboard showing your monthly OTP quota.

== Changelog ==

= 1.1.0 =
* New: phone verification for Contact Form 7 (`[wa_otp_verify your-phone]` form-tag), WPForms, Gravity Forms, and Formidable Forms ("WhatsApp OTP Verify" field) — blocks form submission until the visitor's WhatsApp number is OTP-verified.
* New: experimental Ninja Forms support for the same feature.
* New: native Elementor widget and WPBakery Page Builder element for the login/register form.
* New: country dial-code selector on every phone field (login, registration, checkout, and the new form fields), defaulting from the visitor's browser language.

= 1.0.0 =
* Initial release: Free/Introduction/Starter plans, login/register/WooCommerce-checkout integration, three form styles, own-number connection.

== Upgrade Notice ==

= 1.1.0 =
Adds Contact Form 7 and WPForms phone-verification support.

= 1.0.0 =
Initial release.
