Phone OTP Login & Registration
Add-on ID: kv_phone_otp_login · Edition: CS-Cart & Multi-Vendor · Latest version: 1.0.0 · Compatible with: CS-Cart & Multi-Vendor 4.17.2 – 4.21.x, PHP 7.4 – 8.3 · Changelog: view
Phone OTP Login & Registration lets customers sign in and register with their phone number and a one-time code instead of a password. The code arrives by SMS (Twilio or any SMS gateway with an HTTP API) or by WhatsApp (an approved authentication template of the WhatsApp Cloud API). A test mode lets you try everything before you connect a provider. CS-Cart itself only sends one-time codes by e-mail at checkout; this add-on adds phone sign-in, phone-first registration and phone verification.
- Sign in with phone number: a button under every sign-in form (header pop-up, sign-in page, checkout sign-in) opens a short, mobile-friendly flow: number, code, done. Customers return to the page they came from.
- Registration by phone: a number without an account gets a short form after the code is confirmed (first and last name, e-mail optional or required, or no questions at all). The new account is signed in right away.
- Phone verification in the profile: customers see whether their number is verified and can verify or change it with a code.
- SMS and WhatsApp: Twilio (Messages API or a Messaging Service), any SMS gateway with an HTTP API (URL, body and headers with placeholders), WhatsApp Cloud API authentication templates with the copy-code button, or WhatsApp with SMS as fallback.
- Security built in: codes are stored only as keyed hashes and expire (5 minutes by default); limited wrong attempts per code; rate limits per number, per IP address and for the whole store; allowed countries against SMS pumping fraud; codes bound to the visitor’s session; the same answer for known and unknown numbers (no account discovery); CSRF-protected requests.
- Number handling: international format (E.164), a country selector with calling codes, national numbers with the store’s default country, and existing customers can sign in with the number already saved in their profile.
- Sign-in log: every code sent, sign-in, registration, wrong code and block, with masked numbers, channel and IP address, plus a test send for your provider settings.
- Autofill: the code field supports one-time-code autofill on iOS and Android, and the SMS can carry the WebOTP line for automatic filling in Chrome.
Documentation
Section titled “Documentation”| Page | Contents |
|---|---|
| Installation | Requirements, installing, upgrading, uninstalling |
| Configuration | Settings: general, security and limits, SMS, WhatsApp, license |
| Usage | The customer flow, registration, profile verification, the sign-in log, Multi-Vendor and Ultimate |
| Developer notes | Security design, data model, endpoints, hooks, providers, file map |
| FAQ | Common questions |
Compatibility
Section titled “Compatibility”| CS-Cart / Multi-Vendor | 4.17.2 – 4.21.x (Ultimate and Multi-Vendor editions) |
| PHP | 7.2.5 – 8.3 (whatever your CS-Cart version supports), cURL extension |
| Themes | Responsive and themes based on it (Bright, Nova and others) |
| Full page cache (4.21) | Supported: the sign-in button is the same for every visitor, the phone pages are never cached |
| Providers | Twilio, any HTTP SMS gateway, WhatsApp Cloud API (Meta) |