Adds "Sign in with ZapQR" single sign-on (passkeys, no passwords). The QR widget script is now bundled locally.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3664783,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3664783,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3664783,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3664783,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3664783,"resolution":"1","location":"assets","locale":"","width":1280,"height":1180},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3664783,"resolution":"2","location":"assets","locale":"","width":1280,"height":800}},"screenshots":{"1":"Login page with \"Sign in with ZapQR\" and the QR widget","2":"Settings page: SSO configuration with the URIs to register","3":"ZapQR sign-in ceremony (passkey prompt)"}},"plugin_section":[],"plugin_tags":[710,602,218738,9223,2469],"plugin_category":[38,54],"plugin_contributors":[277360],"plugin_business_model":[],"class_list":["post-358175","plugin","type-plugin","status-publish","hentry","plugin_tags-authentication","plugin_tags-login","plugin_tags-passkey","plugin_tags-passwordless","plugin_tags-sso","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-dasecure","plugin_committers-dasecure"],"banners":{"banner":"https:\/\/ps.w.org\/zapqr-login\/assets\/banner-772x250.png?rev=3664783","banner_2x":"https:\/\/ps.w.org\/zapqr-login\/assets\/banner-1544x500.png?rev=3664783","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/zapqr-login\/assets\/icon-128x128.png?rev=3664783","icon_2x":"https:\/\/ps.w.org\/zapqr-login\/assets\/icon-256x256.png?rev=3664783","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/zapqr-login\/assets\/screenshot-1.png?rev=3664783","caption":"Login page with \"Sign in with ZapQR\" and the QR widget"},{"src":"https:\/\/ps.w.org\/zapqr-login\/assets\/screenshot-2.png?rev=3664783","caption":"Settings page: SSO configuration with the URIs to register"}],"raw_content":"\n
ZapQR Login gives your WordPress site passwordless sign-in, two ways:<\/p>\n\n
A \"Sign in with ZapQR\" button on your login page. Visitors sign in with their ZapQR account \u2014 passkey-first (Face ID \/ Touch ID \/ security key), with an email link as fallback \u2014 via standards-based OpenID Connect single sign-on. One ZapQR account works across every site that offers it.<\/p>\n\n
Users save their WordPress credentials in the ZapQR app; on the login page they scan a QR code and the login form fills and submits itself. Credentials travel phone \u2192 browser over an encrypted WebSocket relay and are never stored on external servers.<\/p>\n\n
This plugin talks to the following services. No data is sent anywhere until a site administrator enables the relevant mode.<\/p>\n\n
ZapQR identity provider<\/strong> (SSO mode) \u2014 ZapQR relay<\/strong> (QR mode) \u2014 QR image service<\/strong> (QR mode) \u2014 Only a verified email address and a stable account identifier, delivered in a cryptographically signed token that the plugin verifies against the provider's published keys. No passwords, no passkeys, no profile data.<\/p><\/dd>\n No. Linking to an existing WordPress user happens only when the ZapQR identity provider asserts the email is verified; unverified emails are rejected outright. You can also disable linking entirely, and new users always get the low-privilege role you configure.<\/p><\/dd>\n With the visitor and the ZapQR identity provider \u2014 never on your WordPress site. Your site only consumes the signed sign-in assertion.<\/p><\/dd>\n Yes, unchanged. It is a separate, coexisting mode: the ZapQR app stores per-site WordPress credentials locally on the phone (Face ID \/ Touch ID protected) and relays them to the browser at login.<\/p><\/dd>\n Yes.<\/p><\/dd>\n\n<\/dl>\n\n\nauth.zapqr.ai<\/code> by default, or a self-hosted issuer the admin configures. When a visitor clicks \"Sign in with ZapQR\" their browser is redirected there to authenticate; your server then exchanges an authorization code (server-to-server) and receives the visitor's email address and its verified status \u2014 nothing else. Provider: DaSecure (zapqr.ai<\/a>, terms and privacy linked there).<\/p>\n\nwss:\/\/relay.zapqr.ai<\/code>, a WebSocket relay that pairs the login page with the visitor's phone using a random session identifier. Credentials pass through end-to-end encrypted and are not stored. Provider: DaSecure (zapqr.ai<\/a>).<\/p>\n\napi.qrserver.com<\/code> renders the QR image. It receives only the random session identifier and your site's hostname \u2014 never credentials. Provider: goqr.me<\/a> (privacy<\/a>).<\/p>\n\n\n\n
\n
What does the site receive about the visitor in SSO mode?<\/h3><\/dt>\n
Can someone take over an existing account?<\/h3><\/dt>\n
Where do passkeys live?<\/h3><\/dt>\n
Does the QR credential mode still work?<\/h3><\/dt>\n
Does this work with multisite?<\/h3><\/dt>\n
1.1.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n