Talao Wallet Login for EUDI Wallet

Published by Web3 Digital Wallet (Talao). This is an independent connector,
not an official European Union or Member State Wallet plugin. It is not
affiliated with or endorsed by the European Union or Member State Wallet providers.
The plugin is free software under GPLv2 or later. Any subscription fees apply
to the separately hosted verification service, not to unlocking plugin code.

Adds a Wallet login button to the WordPress login form, WooCommerce login form
when present, and the [eudi_wallet_login] shortcode. Authorization Code, PKCE
S256, signed ID Token validation and browser-bound single-use state are enabled
without extra security settings. PHP OpenSSL and Sodium are required.

Existing accounts are never matched or merged by email. Users can link their
Wallet from their own WordPress profile after confirming their local password.
New account creation is disabled until the administrator explicitly enables it.
New users receive Subscriber, or Customer if that role exists and is selected.
No administrator roles are issued by this plugin.

Video tutorials

Follow the setup using recorded test interfaces and fictional data. These
installation tutorials do not demonstrate a complete real Wallet authentication.
They use AI-generated narration and have no supplied subtitle tracks.

WordPress installation and configuration (English):

Create your EUDI Wallet connection (English):

French tutorials:
WordPress installation: https://www.youtube.com/watch?v=v8NCgQEXTcU
Create your connection: https://www.youtube.com/watch?v=Hf0SNF6U9fs

External service

This plugin requires an OIDC provider; the default is the EUDI OIDC Bridge at
https://login.openid4vc-hub.com. Saving settings alone makes no provider request.
Starting Wallet login contacts its Discovery endpoint; completing login exchanges
the code server-side, fetches JWKS and UserInfo. The provider receives the client
ID, registered callback, requested scopes, random state/nonce/PKCE challenge and
client authentication at the token endpoint. Identity verification is handled by
the provider and the Wallet. WordPress receives only authorized OIDC attributes.
Contact email, when requested, is verified separately by the bridge after identity verification.

JSON import reads the downloaded credentials locally in the browser; it does
not upload the file to the provider. The file contains a client secret and must
be kept private. Imported values are saved only after the administrator selects
Save configuration. Secrets are encrypted in WordPress storage and not redisplayed.

The free signup button opens the provider’s /register page in a new tab; no
WordPress password or local user information is sent by that button. The form
requests company/contact details, a verified developer email, an application name,
an exact callback URL and the identity/age purpose. The client is created only
after email verification.
No shared client credentials, Hub API keys or tracking service are included.

Provider privacy: https://wallet-connectors.com/privacy/?lang=en
Provider terms: https://wallet-connectors.com/terms/?lang=en
Review service availability, quotas and applicable terms with your provider.

Hosted service pricing

The WordPress plugin is free. The default hosted verification service offers
a Free plan and an optional paid Pro subscription; payment is for the hosted
service, not for unlocking code or features in this plugin.

Free includes 100 verification attempts per UTC calendar month, with a maximum
of 10 per UTC day. Pro costs EUR 39 excluding VAT per month and includes 3,000
verification attempts per UTC calendar month, with a maximum of 300 per UTC day.
Failed or abandoned verification starts count toward these service quotas.

Pro renews automatically each month until cancelled. Manage or cancel the
subscription through the service billing page and its Stripe customer portal.
Cancellation takes effect at the end of the paid period. Removing this plugin
or stopping its use does not cancel the hosted subscription.

The provider enforces the quotas. Changing the plan does not require a new
Client ID, a new client secret or changes to the WordPress configuration.
Subscriptions and payments take place on the service website, outside WordPress.
Subscription availability is controlled by the service; not every Client ID is
currently enabled for paid signup.

Current plans and conditions: https://wallet-connectors.com/pricing/?lang=en
Manage or cancel a subscription: https://wallet-connectors.com/billing/?lang=en

Storage and recovery

The client secret and temporary login data are encrypted using a key derived
from the WordPress auth salt. Rotating salts invalidates encrypted data: re-enter
the client secret and start a new login. The EUDI_WALLET_CLIENT_SECRET constant in
wp-config.php can hold the secret instead of the options table. Do not commit it.

Subject associations are stored as issuer/subject hashes linked to local user
IDs. Account profile attributes are saved only when the account is created;
subsequent Wallet logins do not overwrite local names, email, roles or password.
Expired transactions are rejected immediately and removed by hourly WP-Cron or
on the next login attempt. Deactivation clears transactions and preserves account
associations/settings. No user, identity binding or settings deletion is automatic.

Age verification mode

Choose Age verification (18+) in the bridge signup form and plugin settings.
The dedicated age client uses openid age_verification and never requests email.
Only a signed age_over_18=true result is accepted, with matching UserInfo.
It opens a protected browser age session for five minutes, without creating or
signing into a WordPress account. The ephemeral OIDC sub is discarded.

Age mode gates public WordPress page rendering and public REST access. Keep a
local administrator login for recovery. Configure page/CDN caches to bypass this
site’s protected responses and the age cookie: a cache may respond before PHP.
Direct media/file URLs served by your web server are not protected by PHP and
need separate access rules. Disable or redact callback query strings in hosting
access logs; authorization codes must not be retained there.

Age verification is not a regulatory compliance certification and does not prevent
use of a shared browser/device. Test the complete HTTPS Wallet flow on your site
before opening protected content to users.

Return after cancellation

The connector remembers the local page from which Wallet login was started.
Cancel and return to application on the Wallet login screen first returns to the
registered callback; the plugin then returns to that original page with a message.
This also handles callback errors after state and browser validation. A missing,
expired or invalid transaction shows a safe recovery page instead. External return
URLs are rejected. The registered callback remains unchanged.

The message uses a one-time encrypted Secure/HttpOnly cookie lasting at most two
minutes. Configure page/CDN caches to bypass the __Host-eudi_wp_notice cookie,
as well as the protected age cookie. No provider error details or identity data
are stored in that notice.