About this plugin
Sendity connects WordPress to Sendity Cloud or your own Sendity server. Visitors send a short code from their WhatsApp or mail app, and Sendity confirms who sent it. php, and validates signed Sendity authorizations before starting a normal WordPress session.
Features
- Bundle Sendity Client 0.4.0 locally; no runtime CDN or remote JavaScript.
- Verify phone numbers via WhatsApp, with an explicit SMS fallback when the campaign allows it.
- Show a clear notice instead of a generic error when a Sendity campaign is paused or out of credit.
- Discover public signing keys through JWKS discovery using the WordPress HTTP API.
- Require a valid signature, issuer, audience, pairwise subject, separate auth-request/token IDs, expiry, auth time, AMR/channel, and standard verified email or phone claims.
- Reject replayed or oversized login tokens.
- Create or reuse low-privilege WordPress users only for verified email identities.
- Support verification-only campaigns, including campaigns that verify phone numbers, without creating WordPress users or sessions.
This plugin is a WordPress integration, not a Sendity server.
External services
By default, this plugin connects visitors’ browsers to Sendity Cloud, an external verification service operated by Dachs Consulting GmbH. A site administrator can instead configure a self-hosted Sendity server.
When verification starts, the browser sends the Sendity Campaign ID (public key), site origin, localized interface templates, and transport configuration to the configured Sendity server. Normal web requests also disclose technical data such as the visitor’s IP address and user agent. The visitor then sends the displayed code through the configured channel, which may disclose the email address or phone number being verified to that Sendity service and the relevant email or telecommunications provider.
Short-lived authentication request data, including the request ID and client secret, is stored in browser session storage for the flow.
For WordPress login campaigns, Sendity returns a signed authorization containing the verified email address and potentially profile data supplied through the verification channel. The plugin fetches public signing keys from the configured JWKS endpoint, verifies the authorization locally, prevents replay, creates or reuses the WordPress user, and stores verification metadata as user meta. WordPress passwords and administrator credentials are never sent to Sendity.
When a campaign verifies phone numbers via WhatsApp, the visitor’s WhatsApp app sends the code through WhatsApp (Meta). com/legal/privacy-policy
For Sendity Cloud:
- Terms of Service: https://sendity.io/terms
- Privacy Policy: https://sendity.io/privacy
- Service website: https://sendity.io
For a self-hosted Sendity server, that operator’s terms and privacy policy apply.
Source code and bundled assets
com/sendity/integrations/wordpress
0
The release ZIP includes the generated browser bundle so WordPress does not need Composer, npm, or an external CDN at runtime. md.
Configuration
Important options under Settings -> Sendity:
- Sendity Campaign ID: the Campaign ID from the Sendity campaign settings. The Client still receives it as the public-key attribute.
- Campaign Purpose: WordPress login (email) or Verification only for campaigns such as phone verification.
- Show on wp-login.php: available for WordPress login campaigns.
- Create WordPress Users: create a low-privilege user after verified email login; enabled by default.
- Default Role for New Users: defaults to subscriber; privileged roles are unavailable.
- Login Redirect: defaults to /.
- Server URL: defaults to https://sendity.io/api; change only for a self-hosted server.
- JWKS URL Override: optional; leave empty for automatic JWKS discovery.
- Transport: Auto is recommended.
- Replay TTL: how long used authorizations are remembered.
php.