WordPress OTP Plugin
Add WhatsApp, SMS, or Email OTP verification and one-tap login to any WordPress site with the Mersal-OTP plugin.
Mersal-OTP is a WordPress plugin that adds one-time-password verification and passwordless login to your site's login, registration, and checkout forms — powered by your Mersal account's WhatsApp, SMS, and Email channels instead of a separate OTP provider.
There's a public download page for the plugin on mersal.it — that's the fastest way to grab the current build and see the feature list as shipped.
What it adds to your site
- OTP verification over WhatsApp, SMS, or Email — you choose which channel(s) a form uses to send the one-time code.
- One-tap login — a login flow where the visitor confirms their identity with a single tap instead of copying a code by hand.
- Confirm-link login — sends a clickable confirmation link instead of a numeric code, for flows where a link is a smoother fit than typing digits.
- International phone input — login and registration forms get a proper country-aware phone field (built on intl-tel-input), so numbers are collected in a valid, correctly formatted international shape instead of free-text guesswork.
- A phone-number column in the WordPress Users screen — every user's verified phone number becomes visible right in Users in wp-admin, alongside their username and email, without opening each profile individually.
Message styles and appearance
For WhatsApp specifically, you're not limited to a plain text code. The plugin supports richer WhatsApp message styles — including List and Buttons formatted messages — so the OTP prompt can arrive as a structured, tappable message rather than a block of text. Font customization is also available, so the plugin's on-site verification UI (the code entry screen, prompts, etc.) can match your site's typography instead of looking bolted on.
Connecting to your Mersal account
The plugin doesn't ask for a separate username and password of its own. Instead, it connects via SSO — a single sign-on flow backed by a Sanctum token — so it authenticates directly against your existing Mersal account rather than maintaining its own credential store. Once connected, every OTP the plugin sends draws on the same WhatsApp, SMS, and Email channels you've already set up in your Mersal dashboard, using the same balance and gateways.
Set up a channel first
The plugin sends through your Mersal account's gateways — it doesn't include its own messaging infrastructure. Make sure at least one channel (WhatsApp, SMS, or Email) is connected in your dashboard before relying on it for live OTP delivery. See Quick Start.
Installation
- Download the plugin from its page on mersal.it.
- Install it on your WordPress site the way you would any other plugin (upload the package or install it from your admin dashboard).
- Activate it, then connect it to your Mersal account through the SSO login prompt.
- Configure which forms (login, registration, checkout) use OTP, which channel(s) they offer, and which login mode (code, one-tap, or confirm-link) you want.
The plugin is distributed as an obfuscated, professionally packaged build rather than raw readable source — a standard practice for commercially distributed WordPress plugins, and not something that affects how you install or configure it.
Where this fits
- Running a WooCommerce store? Everything here — OTP login, one-tap, confirm-link — works the same way on WooCommerce's account and checkout forms, since WooCommerce runs on WordPress. See WooCommerce.
- The WhatsApp messages this plugin sends use the same underlying channel documented in WhatsApp.