Passwordless OTP Onboarding
How SmallPict utilizes secure, passwordless One-Time Passwords for instant WordPress site activation.
Passwordless OTP Onboarding
SmallPict eliminates traditional username/password credentials in favor of an enterprise-grade One-Time Password (OTP) authentication mechanism.
This guarantees maximum security against credential stuffing while allowing site administrators to connect their WordPress installations in seconds.
đź”’ Security Architecture
The OTP verification flow uses cryptographic hashing, strict time-to-live limits, and atomic database increments:
| Guardrail | Enforcement Rule |
|---|---|
| Code Generation | Cryptographically secure random 6-digit integer (crypto/rand) |
| Storage Security | OTP codes are hashed using SHA-256 before database storage (never stored plaintext) |
| Expiration (TTL) | Valid for 5 minutes (300 seconds) from issuance |
| Request Cooldown | Minimum 60 seconds cooldown between resend requests |
| Attempt Limit | Maximum 3 invalid verification attempts before automatic session invalidation |
| IP Tracking | Requesting IP is hashed and monitored for anti-bruteforce protection |
🔄 The Authentication Flow
1. Requesting the OTP
When the site administrator submits their email address on the WordPress settings page, the plugin invokes the unauthenticated endpoint:
POST https://api.smallpict.app/v1/plugin/auth/request-otp
{
"email": "admin@example.com",
"site_url": "https://example.com",
"consent": true
}
The SmallPict backend generates an OTP, hashes it into PostgreSQL, and dispatches an email via the high-deliverability Resend email service.
2. Verifying the Code
When the administrator enters the 6-digit code:
POST https://api.smallpict.app/v1/plugin/auth/verify-otp
{
"email": "admin@example.com",
"otp": "839201",
"site_url": "https://example.com"
}
Upon successful verification, SmallPict automatically:
- Provisions a customer account if this is the user's first site.
- Generates a scoped WordPress API Key (
sp_wp_...) and Secret Key. - Automatically stores both keys in the local WordPress database using encrypted transients/options.
🛠️ Troubleshooting Onboarding Issues
Did not receive the verification email?
- Check your spam / junk folder.
- Wait 60 seconds and click the Resend OTP link in the setup wizard.
- Ensure your site's firewall allows outbound HTTPS requests to
https://api.smallpict.app.
Received "Max OTP attempts reached"?
If an incorrect code is entered 3 times, the OTP session is deleted for security. Simply request a new OTP from the setup wizard.