TRC OTP Login lets your visitors log in, register and reset their password with a one-time code sent to their WhatsApp number. It works on its own: no other login plugin is needed.

Login with a WhatsApp code, with an optional password login (phone number or email).
Registration verified by WhatsApp: name, email and password can each be required, optional or hidden.
Lost password: WhatsApp code, then a new password.
Country code selector (245 countries, translated names), priority countries and an optional allow-list.
Login page with 4 layouts (brand panel, centered card, full-screen photo, minimal): colors, logos, font, texts and custom CSS, with a live preview in the admin.
Site-wide popup; menu links (#trc-login, #trc-register) and links to old login pages open it.
Redirects old login addresses (e.g. /my-account/?tab=login), optionally wp-login.php, and replaces the WooCommerce login forms.
Existing accounts: numbers saved by WooCommerce (billing_phone), “OTP Login With Phone Number” (phone_number) or any meta key you add are recognized, and an import normalizes them.
Security: hashed codes, limited attempts, resend delay, limits per number and per IP address, honeypot field, fresh nonce for cached pages.
Sending: Meta WhatsApp Cloud API (approved templates), UltraMsg, Green-API or a custom HTTP API.

TRC OTP Login is not affiliated with or endorsed by WhatsApp or Meta.

Country calling codes and number formats come from libphonenumber-js (MIT license).

External services

This plugin sends the one-time code through the WhatsApp provider you choose in the settings. Only the selected provider is contacted, and only when a code is requested (login, registration, lost password, admin test) or when you load your templates in the admin.

Meta WhatsApp Cloud API (graph.facebook.com): receives the recipient’s phone number and the message (template name, language and parameters, including the code). It is also called from the admin to list your approved templates. Terms: https://www.whatsapp.com/legal/business-terms — Privacy policy: https://www.whatsapp.com/legal/privacy-policy
UltraMsg (api.ultramsg.com): receives the recipient’s phone number and the message text. Terms: https://ultramsg.com/terms-conditions.php — Privacy policy: https://ultramsg.com/privacy-policy.php
Green-API (api.green-api.com or the host you set): receives the recipient’s phone number and the message text. Terms: https://green-api.com/en/user-agreement — Privacy policy: https://green-api.com/en/privacy-policy
Custom HTTP API: receives the data you configure (usually the phone number and the message) at the URL you enter. Its terms are those of the service you choose.
Google Fonts (fonts.googleapis.com, fonts.gstatic.com): when a Google font is selected in the Design tab, the login forms and page load it from Google, which receives the visitor’s IP address. Choose “Theme font” to avoid this request. Privacy policy: https://policies.google.com/privacy

Shortcodes

[trc_wa_login_form tab=”login|register|lostpw” redirect=”URL”]
[trc_wa_login_page]
[trc_wa_login_link tab=”login|register” text=”Log in”]
Menu links #trc-login, #trc-register; classes trc-login-tgr, trc-register-tgr.

Customization

Filters: trc_wa_login_redirect, trc_wa_new_user_data, trc_wa_new_username, trc_wa_new_user_role, trc_wa_registration_errors, trc_wa_find_user_by_phone, trc_wa_countries, trc_wa_otp_code, trc_wa_otp_meta_payload, trc_wa_otp_message_text, trc_wa_ip_hourly_limit, trc_wa_client_ip, trc_wa_isolate_keep.
Actions: trc_wa_logged_in, trc_wa_user_registered, trc_wa_otp_send_failed, trc_wa_otp_after_send.
JavaScript: TRCWAAuth.open(‘login’ | ‘register’), TRCWAAuth.close().
PHP: trc_wa_otp_send( $phone, $code ) sends a code outside the login forms.