ZapQR Login

ZapQR Login gives your WordPress site passwordless sign-in, two ways:

Sign in with ZapQR (SSO) — recommended

A “Sign in with ZapQR” button on your login page. Visitors sign in with their ZapQR account — passkey-first (Face ID / Touch ID / security key), with an email link as fallback — via standards-based OpenID Connect single sign-on. One ZapQR account works across every site that offers it.

• Passkey-first: phishing-resistant WebAuthn sign-in, no passwords anywhere
• Standards-based: OAuth 2.0 authorization-code flow with PKCE; ID tokens verified in the plugin (RS256, JWKS)
• Links existing WordPress users by their verified email — admins keep their role
• New visitors are created with a low-privilege role you choose (Subscriber by default)
• Single logout: logging out of WordPress also ends the ZapQR session
• No external code: the whole flow is server-side redirects and server-to-server calls

QR credential fill (classic)

Users save their WordPress credentials in the ZapQR app; on the login page they scan a QR code and the login form fills and submits itself. Credentials travel phone → browser over an encrypted WebSocket relay and are never stored on external servers.

External services

This plugin talks to the following services. No data is sent anywhere until a site administrator enables the relevant mode.

ZapQR identity provider (SSO mode) — auth.zapqr.ai by default, or a self-hosted issuer the admin configures. When a visitor clicks “Sign in with ZapQR” their browser is redirected there to authenticate; your server then exchanges an authorization code (server-to-server) and receives the visitor’s email address and its verified status — nothing else. Provider: DaSecure (zapqr.ai, terms and privacy linked there).

ZapQR relay (QR mode) — wss://relay.zapqr.ai, a WebSocket relay that pairs the login page with the visitor’s phone using a random session identifier. Credentials pass through end-to-end encrypted and are not stored. Provider: DaSecure (zapqr.ai).

QR image service (QR mode) — api.qrserver.com renders the QR image. It receives only the random session identifier and your site’s hostname — never credentials. Provider: goqr.me (privacy).