Antirius Auth Cloud for WordPress

Antirius Auth Cloud for WordPress

Replace wp-login.php with messenger authentication — Telegram, WhatsApp, MAX. Match users by phone; password fallback enabled by default.

Download plugin
Version 1.0.20

WordPress 5.8+, PHP 7.4+


What the plugin does

  • Replaces wp-login.php with the Antirius Auth Cloud widget.
  • Users authenticate via Telegram, WhatsApp or MAX — no passwords on the main screen.
  • Matches existing WordPress users by phone number only (user meta `phone`).
  • Optional auto-creation of WordPress users on first login.
  • JWT (RS256) signature verification via JWKS — no shared secrets on your server.
  • Password fallback link on the messenger screen is on by default; admins can hide it explicitly.
  • Admin must bind their phone via the widget in settings before the plugin can be enabled.

Before installation

1. Sign in to the Auth Cloud cabinet and create an application.

2. Connect at least one messenger bot (Telegram, WhatsApp or MAX).

3. Add your site origin (e.g. https://yoursite.com) to allowed domains.

4. Copy the application _id — you will enter it as Application ID in WordPress.


Installation

1. Download the plugin archive using the button above.

2. In WordPress admin go to Plugins → Add New → Upload Plugin.

3. Select antirius-auth-cloud.zip and click Install Now, then activate.


Configuration

1. Go to Settings → Antirius Auth Cloud.

2. Enter the Antirius Auth Cloud URL (e.g. https://id.antirius.com) and Application ID.

3. Bind the administrator phone via the button in settings (required before enabling the plugin).

4. Optionally enable auto-create users and set the default role, then enable the plugin and save.

5. wp-login.php now shows the widget.


Settings reference

SettingDescription
Antirius Auth Cloud URLBase URL of your Auth Cloud instance (API, JWKS, default widget.js).
Widget script URL (optional)Override widget.js URL; leave empty to use {Base URL}/widget.js.
Application IDApplication _id from the cabinet.
Auto-create usersCreate a WordPress account if no user matches by phone.
Default roleRole for newly created users.
User matchingPhone only: WordPress user meta `phone` must match the number from Auth Cloud.
Hide password login on messenger screenOpt-out checkbox. Unchecked (default) — backup link to wp-login.php?abc_bypass=1 is shown. Check only to hide the link.

How it works

1. User opens wp-login.php → the plugin shows the Auth Cloud widget instead of the standard form.

2. User scans the QR code or opens a messenger link and confirms login in the bot.

3. The browser exchanges session_id; the plugin verifies JWT (RS256) via JWKS.

4. The plugin finds a user by phone meta or creates one (if enabled), then sets the auth cookie.

5. User is redirected to the dashboard or the original redirect_to URL.


Emergency password login

A link to the standard WordPress login is shown on the messenger screen by default. You can also open it directly (cookie keeps bypass mode after form POST):

https://yoursite.com/wp-login.php?abc_bypass=1

To hide the on-screen link, check “Hide password login on messenger screen” in plugin settings. The direct URL above still works unless you block it separately.

Security

JWT is verified with the public key from JWKS (RS256); app_id in the token must match your Application ID. No shared secrets are stored in WordPress. The public key is cached as a transient.

Requirements

  • WordPress 5.8+, PHP 7.4+ with openssl.
  • Outbound HTTPS from the server to Base URL (session API, JWKS, widget.js).
  • Site origin in application allowed domains in the cabinet.

Documentation