FAQ
Overview · Installation · Configuration · Usage · Developer notes
How is this different from the one-time password in CS-Cart?
Section titled “How is this different from the one-time password in CS-Cart?”CS-Cart sends a one-time password by e-mail, and only at checkout when an account with the typed e-mail exists. This add-on signs customers in with their phone number by SMS or WhatsApp from every sign-in form, registers new customers by phone and verifies numbers in the profile. Both work side by side.
Which SMS providers are supported?
Section titled “Which SMS providers are supported?”Twilio directly, and any provider with an HTTP API through the gateway settings (URL, method, JSON or form body, headers, placeholders for number, text and code). WhatsApp uses the official Cloud API by Meta.
Do I need a WhatsApp template?
Section titled “Do I need a WhatsApp template?”Yes. WhatsApp only allows businesses to start a conversation with an approved template. Create one of the Authentication category in WhatsApp Manager; Meta provides the text and the copy-code button, and approval is usually quick.
What does a sign-in cost?
Section titled “What does a sign-in cost?”The price of one SMS or one WhatsApp authentication message at your provider. The rate limits and the allowed countries keep abuse (and costs) in check.
Can somebody find out whether a number has an account?
Section titled “Can somebody find out whether a number has an account?”No. Until the right code is entered, the answers are the same for every number. After a correct code the customer has proven that the number is theirs.
How are brute-force attacks stopped?
Section titled “How are brute-force attacks stopped?”A code allows a limited number of wrong attempts (5 by default) and expires after a few minutes; new codes are limited per number, per IP address and for the whole store; wrong codes are limited per IP address; a code works only in the browser session that requested it.
Can customers still use their password?
Section titled “Can customers still use their password?”Yes. Passwords, e-mail sign-in, social sign-in and password recovery keep working. Customers who registered by phone without an e-mail address sign in by phone.
Two accounts have the same phone number. What happens?
Section titled “Two accounts have the same phone number. What happens?”Phone sign-in is refused for that number with a message to sign in by e-mail. When one of the accounts verifies the number in its profile, the number belongs to that account.
Does it work with the full page cache of CS-Cart 4.21?
Section titled “Does it work with the full page cache of CS-Cart 4.21?”Yes. The button is the same for every visitor and the phone pages are never cached.
What happens if the license lapses?
Section titled “What happens if the license lapses?”Without a valid license (no key after the 14-day start period, an invalid or revoked key, a domain the license does not cover, or no successful check for 14 days), the phone sign-in buttons are hidden and no new codes are sent. A code that was already sent can still be used. Customers sign in with e-mail and password as before; verified numbers and the log are kept. Once the license is valid again, everything is back.
The admin panel shows a license notice.
Section titled “The admin panel shows a license notice.”Open Add-ons → Manage add-ons → Phone OTP Login & Registration: the License card at the top says what is wrong: no key, a key for another add-on, a revoked license, or a domain that the license does not cover. Fix it on the License tab and click Check now. See License.
Does the add-on work on my staging copy?
Section titled “Does the add-on work on my staging copy?”Yes. Subdomains of your licensed domain (for example staging.example.com) and local development hosts (localhost, private IP addresses, *.local, *.test) are covered by the same license.
What happens if your license server is down?
Section titled “What happens if your license server is down?”Nothing changes for 14 days: the add-on keeps working and retries every hour. Only if no check succeeds for 14 days is it switched off until the next successful check.
Does the license check slow down my storefront or checkout?
Section titled “Does the license check slow down my storefront or checkout?”No. The check runs only in the admin panel or from cron, at most once a day, never while customers browse, sign in or check out.
Still stuck?
Section titled “Still stuck?”Work through the troubleshooting guide, then contact support with your CS-Cart version, edition, PHP version and the add-on version (1.0.0).