About this plugin
The DocCheck Access plugin integrates DocCheck’s OAuth2 authentication system into your WordPress site, allowing medical professionals to log in using their DocCheck credentials. Note: Using DocCheck Access requires the Economy or Business license model. This plugin cannot be used with the Basic license model. Please contact DocCheck for details on available license models. Features Adds a DocCheck login button via shortcode or automatic page-level protection OAuth 2.0 Authorization Code flow with PKCE for secure authentication Two authentication modes: Anonymous Session and WordPress User creation Per-page, post, and WooCommerce product protection with role-based access control Configurable scope and user metadata mapping Template override support for protected pages Hooks and filters for developers to customize behavior External Services This plugin connects to the following external services: DocCheck OAuth Server ( https://auth.doccheck.com ) Used to exchange the OAuth authorization code for an access token and to retrieve the authenticated user’s profile data. This connection is only made when a visitor actively clicks the DocCheck login button. Please refer to the DocCheck Privacy Policy and DocCheck Terms of Service . DocCheck CDN ( https://dccdn.de ) The DocCheck login button is a web component whose script is served from DocCheck’s CDN. It is loaded only on pages where the [docacc_login] shortcode or page-level protection is active — not on every page. Please refer to the DocCheck Privacy Policy . No data is transmitted to any other third-party service. Requirements WordPress 5.0 or higher PHP 7.2 or higher A DocCheck OAuth client ID and client secret (obtainable from DocCheck) General Settings Go to Settings > DocCheck Login in your WordPress admin to configure the plugin. You can also open the settings directly from the Settings link on the WordPress plugins overview screen. OAuth Credentials Client ID — Your DocCheck OAuth Client ID. Client Secret — Your DocCheck OAuth Client Secret. Redirect URI — Auto-generated based on your site URL. Copy this value into your DocCheck application settings. Redirection & Debug Default Target Page — The page users land on after a successful login. Debug Mode — Logs detailed API and authentication information. Disable on production sites. Content Protection Restrict Options before Login Use Custom Template — Default behavior. Replaces the protected page output with the protected-content template or your theme override. Redirect to Page Link — Sends unauthenticated visitors to a public page of your choice. After login, they are redirected back to the originally requested protected page. Make all Pages Private — Requires DocCheck login for every page on the site. Auto-assign Parent Configurations — Child pages automatically inherit their parent page’s protection status. Login Button Version — Pin a specific component version (e.g. 3.2.7 ) or use @latest to always load the most recent version. User Management Authentication Modes Anonymous Session — Users are authenticated via DocCheck but no WordPress user account is created. Enable Anonymous Session Profile Data to retrieve the selected scopes for the current PHP session. The data is not stored as WordPress user data and is available through docacc_get_user_data() and docacc_session_created . WordPress User — A WordPress user account is created or linked on the visitor’s first DocCheck login. Allows persistent storage of user properties and role-based access control. Role & Metadata Default User Role — The WordPress role assigned to newly created DocCheck users. Only low-privilege roles (those without manage_options or edit_others_posts capabilities) are available for selection. Administrator and Editor roles cannot be assigned to DocCheck users. Automatic User Creation — Disabled by default. In WordPress User mode, local user creation for first-time DocCheck logins must be explicitly enabled by an administrator. Scope & Property Selection — Choose which DocCheck scopes to request and which user properties to store as WordPress user metadata. Developer Hooks Actions docacc_user_created — Fires after a new WordPress user is created via DocCheck login. Parameters: $user_id (int), $user_data (array) docacc_user_logged_in — Fires when an existing user logs in via DocCheck. Parameters: $user_id (int), $user_data (array) docacc_session_created — Fires when a user is authenticated in anonymous session mode. Enable Anonymous Session Profile Data to retrieve selected profile fields for the current PHP session; no WordPress user or user meta is created. Parameters: $user_data (array) Filters docacc_map_role — Customize role assignment based on DocCheck user data. Parameters: $current_role (string), $user_data (array), $user_id (int) Note: roles with manage_options or edit_others_posts capabilities are silently rejected for security reasons. docacc_protected_template — Override the template used for protected pages. Parameters: $template (string) docacc_is_authenticated — Override the authentication check result. Parameters: $authenticated (bool) docacc_user_data — Modify the DocCheck user data array before it is used. Parameters: $user_data (array) Template Functions // Check if the current visitor is authenticated via DocCheck docacc_is_authenticated(); // returns bool // Get the authenticated user's DocCheck profile fields docacc_get_user_data(); // returns array, empty if not authenticated Example in a theme template: <?php if ( docacc_is_authenticated() ) : ?> <div class="hcp-content">Visible only to DocCheck users.</div> <?php else : ?> <?php echo do_shortcode( '[docacc_login]' ); ?> <?php endif; ?> Custom Protected Page Template The plugin provides a default template for pages that are DocCheck protected. You can customize this in two ways. Theme Template File Create doccheck-protected.php in your active theme root. The plugin will load it automatically instead of the built-in fallback template. <?php /** * Template used for DocCheck protected pages. * * Place this file in your active theme: * /wp-content/themes/your-theme/doccheck-protected.php */ if ( ! defined( 'ABSPATH' ) ) { exit; } get_header(); ?> <main class="doccheck-protected-page"> <section class="doccheck-protected-box"> <h1><?php the_title(); ?></h1> <p>This content is protected. Please log in with your DocCheck account to continue.</p> <?php echo do_shortcode( '[docacc_login samepageredirect="1"]' ); ?> </section> </main> <?php get_footer(); ?> WordPress Filter Use the docacc_protected_template filter in your theme’s functions.php when you want to load a template from a custom location. add_filter( 'docacc_protected_template', function( $template ) { $custom_template = get_stylesheet_directory() . '/templates/doccheck/custom-protected.php'; if ( file_exists( $custom_template ) ) { return $custom_template; } return $template; } ); How the template is used: the plugin loads this template only for singular protected content when the visitor is not authenticated. Your template runs as a normal WordPress theme template, so you can use functions like get_header() , get_footer() , the_title() , and do_shortcode() . In most cases, you should render the login button with [docacc_login samepageredirect="1"] so the user returns to the same protected page after login. User Metadata Stored In WordPress User mode, the following meta fields are stored per user (subject to selected scopes): docacc_unique_id — DocCheck unique identifier (always stored) docacc_profession — Profession name docacc_country — Country ISO code docacc_language — Interface language first_name , last_name — Name fields docacc_email — Email address docacc_discipline_name — Medical discipline docacc_activity_name — Activity type docacc_area_code , docacc_street , docacc_city , docacc_state — Address fields docacc_last_login — Timestamp of last DocCheck login