Phone OTP Login & Registration for CS-Cart and Multi-Vendor

What it does

Phone OTP Login & Registration adds a "Sign in with phone number" button to every sign-in form of CS-Cart and Multi-Vendor: the header pop-up, the sign-in page and checkout. Customers type their number, receive a one-time code by SMS or WhatsApp and are signed in. New numbers get a short registration form, and customers can verify their number in the profile. For stores whose customers prefer the phone to passwords: mobile shoppers, marketplaces and regions where WhatsApp is the main channel.

How it works

Install the add-on

It starts in test mode, where codes appear on screen for your test numbers, so you can try the flow at once. Then enter Twilio credentials, any SMS gateway with an HTTP API, or your WhatsApp Cloud API number and authentication template, and send a test code from the log page. Choose SMS, WhatsApp or WhatsApp with SMS fallback, the default and allowed countries, code length, lifetime and limits. Customers sign in by phone; existing customers can use the number already saved in their profile.

Features

Sign in with phone number under every sign-in form, including checkout
Registration by phone with a short form (name, e-mail optional)
SMS by Twilio or any gateway with an HTTP API
WhatsApp Cloud API authentication templates with copy-code button, SMS fallback
Phone verification and change in the customer profile
Existing customers sign in with the number already in their profile
Hashed, expiring codes, limited attempts and rate limits per number, IP and store
Allowed countries against SMS pumping fraud, no account discovery
Country selector, E.164 numbers, one-time-code autofill and WebOTP
Sign-in log with test send; test mode for setup
CS-Cart, CS-Cart Ultimate and Multi-Vendor, 4.17.2 to 4.21

What you get

Package	kv_phone_otp_login-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support	12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License	1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works

Compatibility

We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.

CS-Cart version and edition compatibility
CS-Cart version	CS-Cart	CS-Cart Ultimate	Multi-Vendor	Multi-Vendor Ultimate
4.22 and later	Testing next	Testing next	Testing next	Testing next
4.21.2	Supported	Supported	Tested	Supported
4.20.x	Supported	Supported	Supported	Supported
4.19.x	Supported	Supported	Supported	Supported
4.18.x	Supported	Supported	Supported	Supported
4.17.2	Tested	Supported	Tested	Supported
Before 4.17.2	Not supported	Not supported	Not supported	Not supported

Last tested build: Multi-Vendor 4.21.2, Oct 17, 2026Tested on: Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2

Requirements

PHP	CS-Cart or CS-Cart Multi-Vendor 4.17.2 – 4.21.x, PHP 7.2.5 – 8.3 with the cURL extension
Requirement	For live use, one provider account: Twilio, another SMS gateway with an HTTP API, or a WhatsApp Business account on the Cloud API with an approved template of the Authentication category. Test mode needs nothing
Requirement	No cron job is needed
Core changes	None. Hooks and template overrides only

1.0.0

Oct 17, 2026

Latest

Added 7

Sign in with phone number under every sign-in form (header pop-up, sign-in page, checkout) with a one-time code by SMS or WhatsApp.
Registration by phone with a short form (name and e-mail configurable), and phone verification in the customer profile.
Providers: Twilio, any SMS gateway with an HTTP API, WhatsApp Cloud API authentication templates (copy-code button), WhatsApp with SMS fallback; test mode with codes on screen for test numbers.
Security: hashed and expiring codes bound to the session, limited attempts, rate limits per number, IP address and store, allowed countries, no account discovery, CSRF-checked requests.
Number handling: E.164 normalisation, country selector with calling codes, matching of numbers saved in customer profiles.
Sign-in log with filters and a provider test send.
Domain-bound licence check and self-healing upgrades.

Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. First release.

How is this different from the one-time password in CS-Cart?

CS-Cart sends a one-time password by e-mail, and only at checkout when an account with the typed e-mail exists. This add-on signs customers in with their phone number by SMS or WhatsApp from every sign-in form, registers new customers by phone and verifies numbers in the profile. Both work side by side.

Which SMS providers are supported?

Twilio directly, and any provider with an HTTP API through the gateway settings (URL, method, JSON or form body, headers, placeholders for number, text and code). WhatsApp uses the official Cloud API by Meta.

Do I need a WhatsApp template?

Yes. WhatsApp only allows businesses to start a conversation with an approved template. Create one of the Authentication category in WhatsApp Manager; Meta provides the text and the copy-code button, and approval is usually quick.

What does a sign-in cost?

The price of one SMS or one WhatsApp authentication message at your provider. The rate limits and the allowed countries keep abuse (and costs) in check.

Can somebody find out whether a number has an account?

No. Until the right code is entered, the answers are the same for every number. After a correct code the customer has proven that the number is theirs.

How are brute-force attacks stopped?

A code allows a limited number of wrong attempts (5 by default) and expires after a few minutes; new codes are limited per number, per IP address and for the whole store; wrong codes are limited per IP address; a code works only in the browser session that requested it.

Can customers still use their password?

Yes. Passwords, e-mail sign-in, social sign-in and password recovery keep working. Customers who registered by phone without an e-mail address sign in by phone.

Two accounts have the same phone number. What happens?

Phone sign-in is refused for that number with a message to sign in by e-mail. When one of the accounts verifies the number in its profile, the number belongs to that account.

Does it work with the full page cache of CS-Cart 4.21?

Yes. The button is the same for every visitor and the phone pages are never cached.

What happens if the license lapses?

Without a valid license (no key after the 14-day start period, an invalid or revoked key, a domain the license does not cover, or no successful check for 14 days), the phone sign-in buttons are hidden and no new codes are sent. A code that was already sent can still be used. Customers sign in with e-mail and password as before; verified numbers and the log are kept. Once the license is valid again, everything is back.

The admin panel shows a license notice.

Open Add-ons → Manage add-ons → Phone OTP Login & Registration: the License card at the top says what is wrong: no key, a key for another add-on, a revoked license, or a domain that the license does not cover. Fix it on the License tab and click Check now. See License.

Does the add-on work on my staging copy?

Yes. Subdomains of your licensed domain (for example staging.example.com) and local development hosts (localhost, private IP addresses, .local, .test) are covered by the same license.

What happens if your license server is down?

Nothing changes for 14 days: the add-on keeps working and retries every hour. Only if no check succeeds for 14 days is it switched off until the next successful check.

Does the license check slow down my storefront or checkout?

No. The check runs only in the admin panel or from cron, at most once a day, never while customers browse, sign in or check out.

InstallationRequirements, Install, Upgrading, Uninstalling ConfigurationGeneral, Security & limits, SMS, WhatsApp, License UsageSigning in with a phone number, Registering with a phone number, Verifying the number in the profile, Existing customers, Sign-in log, Test mode Developer notesHow a sign-in works, Data model, Controllers and endpoints, Providers, Full page cache (4.21), License check FAQ14 answers to common questions.

Browse by category

Goals

Best seller

Phone OTP Login & Registration

What it does

How it works

Install the add-on

Features

What you get

Compatibility

Requirements

Added 7

Details

Support

Frequently bought together

Also from Kavio Labs

Product Videos Gallery

Shipping Goal Progress Bar

Vendor Vacation Mode

See the roadmap