Passwordless OTP Onboarding
How SmallPict utilizes secure, passwordless One-Time Passwords for instant WordPress site activation.
Passwordless OTP Onboarding
SmallPict eliminates traditional username/password credentials in favor of an enterprise-grade One-Time Password (OTP) authentication mechanism.
This guarantees maximum security against credential stuffing while allowing site administrators to connect their WordPress installations in seconds.
🔒 Security Architecture
The OTP verification flow uses cryptographic hashing, strict time-to-live limits, and atomic database increments:
| Guardrail | Enforcement Rule |
|---|---|
| Code Generation | Cryptographically secure random 6-digit integer (crypto/rand) |
| Storage Security | OTP codes are hashed using SHA-256 before database storage (never stored plaintext) |
| Expiration (TTL) | Valid for 5 minutes (300 seconds) from issuance |
| Request Cooldown | Minimum 60 seconds cooldown between resend requests |
| Attempt Limit | Maximum 3 invalid verification attempts before automatic session invalidation |
| IP Tracking | Requesting IP is hashed and monitored for anti-bruteforce protection |
🔄 The Authentication Flow
1. Requesting the OTP
When the site administrator submits their email address on the WordPress settings page, the plugin invokes the unauthenticated endpoint:
POST https://api.smallpict.app/v1/plugin/auth/request-otp
{
"email": "admin@example.com",
"site_url": "https://example.com",
"consent": true
}
The SmallPict backend generates an OTP, hashes it into PostgreSQL, and dispatches an email via the high-deliverability Resend email service.
2. Verifying the Code
When the administrator enters the 6-digit code:
POST https://api.smallpict.app/v1/plugin/auth/verify-otp
{
"email": "admin@example.com",
"otp": "839201",
"site_url": "https://example.com"
}
Upon successful verification, SmallPict automatically:
- Provisions a customer account if this is the user's first site.
- Generates a scoped WordPress API Key (
sp_wp_...) and Secret Key. - Automatically stores both keys in the local WordPress database using encrypted transients/options.
🛠️ Troubleshooting Onboarding Issues
Did not receive the verification email?
- Check your spam / junk folder.
- Wait 60 seconds and click the Resend OTP link in the setup wizard.
- Ensure your site's firewall allows outbound HTTPS requests to
https://api.smallpict.app.
Received "Max OTP attempts reached"?
If an incorrect code is entered 3 times, the OTP session is deleted for security. Simply request a new OTP from the setup wizard.