Passwordless OTP Onboarding

How SmallPict utilizes secure, passwordless One-Time Passwords for instant WordPress site activation.

SmallPict eliminates traditional username/password credentials in favor of an enterprise-grade One-Time Password (OTP) authentication mechanism.

This guarantees maximum security against credential stuffing while allowing site administrators to connect their WordPress installations in seconds.

🔒 Security Architecture

The OTP verification flow uses cryptographic hashing, strict time-to-live limits, and atomic database increments:

Guardrail	Enforcement Rule
Code Generation	Cryptographically secure random 6-digit integer (`crypto/rand`)
Storage Security	OTP codes are hashed using SHA-256 before database storage (never stored plaintext)
Expiration (TTL)	Valid for 5 minutes (300 seconds) from issuance
Request Cooldown	Minimum 60 seconds cooldown between resend requests
Attempt Limit	Maximum 3 invalid verification attempts before automatic session invalidation
IP Tracking	Requesting IP is hashed and monitored for anti-bruteforce protection

When the site administrator submits their email address on the WordPress settings page, the plugin invokes the unauthenticated endpoint:

POST https://api.smallpict.app/v1/plugin/auth/request-otp

{
  "email": "admin@example.com",
  "site_url": "https://example.com",
  "consent": true
}

The SmallPict backend generates an OTP, hashes it into PostgreSQL, and dispatches an email via the high-deliverability Resend email service.

When the administrator enters the 6-digit code:

POST https://api.smallpict.app/v1/plugin/auth/verify-otp

{
  "email": "admin@example.com",
  "otp": "839201",
  "site_url": "https://example.com"
}

Upon successful verification, SmallPict automatically:

Provisions a customer account if this is the user's first site.
Generates a scoped WordPress API Key (sp_wp_...) and Secret Key.
Automatically stores both keys in the local WordPress database using encrypted transients/options.

Check your spam / junk folder.
Wait 60 seconds and click the Resend OTP link in the setup wizard.
Ensure your site's firewall allows outbound HTTPS requests to https://api.smallpict.app.

If an incorrect code is entered 3 times, the OTP session is deleted for security. Simply request a new OTP from the setup wizard.