Passwordless OTP Onboarding
How the WordPress plugin connects your site with a one-time email code instead of a password.
The WordPress plugin connects your site with a one-time password (OTP) sent by email instead of a username and password.
This removes the risk of reused or stuffed passwords and takes less than a minute.
Security measures
The OTP flow uses hashing, short expiry times, and attempt limits:
| Guardrail | Enforcement Rule |
|---|---|
| Code Generation | Cryptographically secure random 6-digit code |
| Storage Security | OTP codes are hashed using SHA-256 before database storage (never stored plaintext) |
| Expiration (TTL) | Valid for 5 minutes (300 seconds) from issuance |
| Request Cooldown | Minimum 60 seconds cooldown between resend requests |
| Attempt Limit | Maximum 3 invalid verification attempts before automatic session invalidation |
| IP Tracking | Requesting IP is hashed and monitored for anti-bruteforce protection |
Authentication flow
1. Requesting the OTP
When the site administrator submits their email address on the WordPress settings page, the plugin invokes the unauthenticated endpoint:
POST https://api.smallpict.app/v1/plugin/auth/request-otp
{ "email": "admin@example.com", "site_url": "https://example.com", "consent": true}SmallPict generates the code, stores only a hash of it, and emails the code to the address you entered.
2. Verifying the Code
When the administrator enters the 6-digit code:
POST https://api.smallpict.app/v1/plugin/auth/verify-otp
{ "email": "admin@example.com", "otp": "839201", "site_url": "https://example.com"}After the code is verified, SmallPict:
- Provisions a customer account if this is the user's first site.
- Generates a scoped WordPress API Key (
sp_wp_...) and Secret Key. - Stores both keys in the WordPress database as encrypted options.
Troubleshooting
Did not receive the verification email?
- Check your spam / junk folder.
- Wait 60 seconds and click the Resend OTP link in the setup wizard.
- Ensure your site's firewall allows outbound HTTPS requests to
https://api.smallpict.app.
Received "Max OTP attempts reached"?
After 3 incorrect codes, the OTP session is deleted. Request a new code from the setup wizard.