XeroWP
LinxyPass
LinxyPass

LinxyPass

0/5 (0 ratings) — active installs Updated Nov 10, 2026
authenticationbiometricloginpasswordlesssecurity
Download v2.20.4 Plugin Website

LinxyPass removes passwords from your WordPress login. When a member signs in, they approve the request on a device they already own: their phone (Face ID or fingerprint) or a tap on their watch. Nothing to remember, nothing to phish, and no password for this sign-in method.

How a sign-in works

  1. The member opens your login page. It shows your site’s own login image, a Linxy Mark.
  2. They scan the image with the free Linxy App, or tap to sign in from their phone’s home screen or their Apple Watch or Wear OS watch.
  3. They confirm with Face ID, fingerprint, or a tap on the watch.
  4. The Linxy platform confirms the approval to your site’s server, and your site signs the member in.

What the plugin gives you

  • Set-up from the plugin’s own screen: pick a login image and scan once with the Linxy App
  • LinxyPass on wp-login.php in the layout you choose: full screen, combined, image tile, or button
  • Three sign-in methods to choose from: LinxyPass or password; LinxyPass only for members who have set it up; or no passwords for anyone
  • WordPress multisite: a Network Admin screen for every site, and sites that are not set up yet can sign members in through the main site’s LinxyPass
  • [linxypass] shortcode for custom login pages and [linxypass_enable] so members can turn on LinxyPass from an account page
  • WooCommerce My Account integration
  • Every sign-in is confirmed server to server; nothing is trusted from the browser
  • Invitations, access requests, and a member list with revoke and block
  • Optional automatic accounts for new members

What you need

  • A paid Linxy plan for your site. LinxyPass is included in every paid plan, from $49 a month for one site, with no separate LinxyPass fee. Launch offer: the first 100 site owners who go live with LinxyPass get six months free. See https://linxypass.com/pricing/ for current plans.
  • The plugin creates your site’s LinxyPass record for you during set-up. Plugin home page and set-up guide: https://linxypass.com/wordpress/
  • Members need the free Linxy App for iPhone or Android. Apple Watch and Wear OS approvals are supported.

Terms and privacy

Use of this plugin requires a Linxy account and is subject to the Linxy Terms of Service (https://lnxy.me/terms) and Privacy Policy (https://lnxy.me/privacy).

Credits

The admin screens use the Poppins typeface (Copyright 2020 The Poppins Project Authors), bundled with the plugin under the SIL Open Font License 1.1; see assets/fonts/OFL.txt.

The setup screen’s QR code is drawn in the browser by qrcode-generator 1.4.4 (Copyright (c) 2009 Kazuhiko Arase, MIT license), bundled unmodified as assets/js/qrcode.js. No QR service is contacted.

External services

This plugin relies on one external service: the Linxy platform, operated by Linxy Media LLC at https://lnxy.me. LinxyPass is a sign-in service, so the plugin cannot work without it. The plugin uses no other external service. Fonts and the setup QR code generator are bundled with the plugin.

  • Service: Linxy platform (LinxyPass), https://lnxy.me
  • Terms of Service: https://lnxy.me/terms
  • Privacy Policy: https://lnxy.me/privacy

All requests use HTTPS. WordPress passwords are never sent. Below is every connection the plugin makes, when it happens, and what is sent.

Before the site is connected

  • Show Linxy starter images (only when the administrator clicks that button on the setup screen): GET https://lnxy.me/api/fusion/login/templates. Nothing about the site or its users is sent. The browser then loads the image thumbnails from lnxy.me. Opening the setup screen alone contacts nothing.
  • Activate / Set up (when the administrator clicks it): POST https://lnxy.me/api/fusion/login/provision. Sends the site URL, site name, WordPress version, the administrator’s display name and email address, the chosen login image, the login layout and the verification level. Returns a partner ID and an API key, which are stored in WordPress options and never sent to the browser.
  • Use an existing API key (when the administrator pastes one): GET https://lnxy.me/api/fusion/login/partner/info with the API key, to confirm it belongs to this site.

On the login page and other pages that show the LinxyPass button

  • The browser loads the LinxyPass sign-in script from https://lnxy.me/static/linxypass.js. It creates a sign-in session by sending the site’s partner ID (and, for a browser that has signed in before, a remembered-browser token so the request can go to the member’s phone). It shows the site’s sign-in image and checks the session status until the member approves on their phone.
  • When the member has approved: GET https://lnxy.me/api/fusion/login/status. Sends the session ID with the API key. Receives a site-specific member identifier. The plugin then signs that member in through WordPress.
  • After a sign-in or enrollment: POST https://lnxy.me/api/fusion/login/enrich and https://lnxy.me/api/partner/requests/lookup-by-fusion. Sends the member’s site-specific identifier, WordPress display name and email address, so the site owner can recognise the member in their member list.
  • One-tap sign-in from the Linxy App: POST https://lnxy.me/api/fusion/login/appconsume. Sends the single-use token from the link the member opened.
  • Members who enroll from inside their account: POST https://lnxy.me/api/partner/enrollment/vouch. Sends the session ID and the member’s WordPress user ID and email address.

In wp-admin, after the site is connected (administrators only)

  • LinxyPass screens check the site’s status: GET https://lnxy.me/api/partner/owner-status (API key and the site’s host name) and https://lnxy.me/api/fusion/login/partner/info (API key). They also read the webhook secret and the member count.
  • Members and Access Requests tabs: https://lnxy.me/api/partner/members, /api/partner/requests, /api/partner/requests/approve, /api/partner/requests/deny and /api/partner/members/revoke. These send the API key and, for an action, the member’s email address and site-specific identifier.
  • Invitations tab: POST https://lnxy.me/api/partner/requests/invite. Sends the invited person’s name and email address so a personal enrollment link can be made. The invitation email itself is sent by WordPress, not by Linxy.
  • Owner details: POST https://lnxy.me/api/fusion/login/partner/owner/update. Sends the site owner’s display name and email address when they change in WordPress.
  • Plan and login image: POST https://lnxy.me/api/fusion/login/partner/tier (the chosen verification level) and https://lnxy.me/partner/mark/strengthen (partner ID and API key, when the owner asks for a stronger login image).
  • “Test connection”, “Open dashboard” and “Brand your login image” buttons: https://lnxy.me/api/fusion/login/create, /api/partner/dashboard-link and /api/partner/brand-session. Each sends the API key and returns a short-lived link or a test result.

By connecting the plugin you create a Linxy partner account for your site and agree to the Terms of Service on behalf of your site.