About this plugin
ZapQR Login gives your WordPress site passwordless sign-in, two ways:
Sign in with ZapQR (SSO) — recommended
A “Sign in with ZapQR” button on your login page. Visitors sign in with their ZapQR account — passkey-first (Face ID / Touch ID / security key), with an email link as fallback — via standards-based OpenID Connect single sign-on. One ZapQR account works across every site that offers it.
- Passkey-first: phishing-resistant WebAuthn sign-in, no passwords anywhere
- Standards-based: OAuth 2.0 authorization-code flow with PKCE; ID tokens verified in the plugin (RS256, JWKS)
- Links existing WordPress users by their verified email — admins keep their role
- New visitors are created with a low-privilege role you choose (Subscriber by default)
- Single logout: logging out of WordPress also ends the ZapQR session
- No external code: the whole flow is server-side redirects and server-to-server calls
QR credential fill (classic)
Users save their WordPress credentials in the ZapQR app; on the login page they scan a QR code and the login form fills and submits itself. Credentials travel phone → browser over an encrypted WebSocket relay and are never stored on external servers.
External services
This plugin talks to the following services. No data is sent anywhere until a site administrator enables the relevant mode.
ai by default, or a self-hosted issuer the admin configures. When a visitor clicks “Sign in with ZapQR” their browser is redirected there to authenticate; your server then exchanges an authorization code (server-to-server) and receives the visitor’s email address and its verified status — nothing else. ai, terms and privacy linked there).
ai, a WebSocket relay that pairs the login page with the visitor’s phone using a random session identifier. Credentials pass through end-to-end encrypted and are not stored. ai ).
com renders the QR image. It receives only the random session identifier and your site’s hostname — never credentials. me ( privacy ).