WhatsApp OTP and notifications for WordPress

Verify a phone number at sign-up or login with a WhatsApp code, and message your users from your own number.

The Oxtro plugin targets WooCommerce stores and is not yet listed in the WordPress plugin directory. There is no plugin for WordPress sites without WooCommerce. Until then, call the Oxtro API from your own plugin or theme with the WordPress HTTP functions, as shown below.

Create account Read the quickstart

Phone verification without storing codes

Call the OTP API with a phone number. Oxtro generates the code, sends it on WhatsApp and checks what the user typed. WordPress only keeps a request ID.

Built-in abuse limits

Codes expire, lock after too many wrong tries, and cannot be requested again during a cooldown. Hourly and daily caps per phone stop a form from being used to flood one person.

Notifications from any hook

Anything WordPress can react to can send a WhatsApp message: a form submission, a new booking, a membership renewal. It is one wp_remote_post call to the Messages API.

Your number, your conversations

Messages come from a WhatsApp number you linked by QR code. Oxtro is not the official WhatsApp Business Platform and is not affiliated with WhatsApp or Meta.

How it works

Link your number
Create an Oxtro workspace and scan the QR code with the phone that owns the number.
Create a scoped key
For verification, a key needs only the otp:send and otp:verify scopes.
Call the API
Send a code when the user submits their number, then verify what they type.

Works today: verify a phone number

Two helper functions using wp_remote_post. Store the returned request ID in the user session between the two steps.

PHP

<?php
// Send a code. Oxtro generates it, so WordPress never stores it.
function oxtro_send_code(string $phone) {
    $response = wp_remote_post('https://api.getoxtro.com/v1/otp/send', [
        'timeout' => 10,
        'headers' => [
            'Authorization' => 'Bearer ' . OXTRO_API_KEY,
            'Content-Type'  => 'application/json',
        ],
        'body' => wp_json_encode([
            'connection_id' => OXTRO_CONNECTION_ID,
            'to'            => $phone,
        ]),
    ]);

    if (is_wp_error($response) || wp_remote_retrieve_response_code($response) !== 200) {
        return null;
    }

    return json_decode(wp_remote_retrieve_body($response), true)['request_id'];
}

// Check what the user typed. 200 means verified; 400 means wrong, expired or locked.
function oxtro_check_code(string $request_id, string $code): bool {
    $response = wp_remote_post('https://api.getoxtro.com/v1/otp/verify', [
        'timeout' => 10,
        'headers' => [
            'Authorization' => 'Bearer ' . OXTRO_API_KEY,
            'Content-Type'  => 'application/json',
        ],
        'body' => wp_json_encode(['request_id' => $request_id, 'code' => $code]),
    ]);

    return !is_wp_error($response) && wp_remote_retrieve_response_code($response) === 200;
}

Questions about WordPress

Is there an Oxtro plugin in the WordPress plugin directory?

Not yet. A plugin for WooCommerce stores is built and waiting to be listed. Today you can call the Oxtro REST API from your own plugin or theme code.

Can I use WhatsApp codes for WordPress login?

Yes, by adding the two API calls to your own login flow: one to send the code and one to verify it. The WooCommerce plugin adds a ready-made login box to the My account page.

Where should I keep the API key?

On the server only, for example as a constant in wp-config.php. Never print it in a page or use it in JavaScript that runs in the browser.

Use casesWhatsApp OTPVerify phone numbers with one-time codes delivered on WhatsApp.Read more IntegrationsWooCommerceWhatsApp order updates for a WooCommerce store, sent from your own number.Read more DocsOTPVerify a phone number in two calls. Oxtro generates the code, delivers it on WhatsApp and checks what the user typed.Read more DocsPHPPlain PHP with the curl extension. No Composer package needed.Read more

Connect your first number today

Create a workspace, scan the QR code and send a message.

Create account