The Advanced Authentication plugin provides advanced authentication features for nopCommerce including OTP login, one-time login links, sign-out from all devices, and logged-in device tracking.
PRE-REQUISITES
- This plugin requires the Nop-Station Core plugin to be installed and enabled.
INSTALLATION
- Ensure the Nop-Station Core plugin is installed and enabled.
- Navigate to Administration → Configuration → Local plugins
· Locate the Advanced Authentication plugin (Group: Nop-Station).
· Click Install.
· To make the plugins functional, Restart the application.
Note: The plugin automatically installs required permissions, localization resources, and email message templates during installation.
Admin Panel Operations
Configuration
Access the configuration page via Admin → Nop Station → Advanced Authentication → Configuration
The configuration page has two sections: General Settings and OTP & Link Settings.
General Settings
- Enable Plugin: Master on/off switch for all plugin features.
- Enable OTP Login: Activates the OTP-based login flow on the public store.
- Enable One-Time Login Link: Activates the one-time login link flow on the public store.
- Enable Device List: Activates the logged-in devices page in the customer account area.
- Required Re-Login After Password Change: When enabled, changing a password will invalidate all existing sessions, requiring the customer to log in again on all devices.
OTP & Link Settings
- OTP Expiry (minutes): How long an OTP code remains valid after generation (default: 5 minutes).
- Login Link Expiry (minutes): How long a one-time login link remains valid after generation (default: 15 minutes).
- Resend OTP Delay (seconds): Minimum wait time before a customer can request a new OTP code (default: 30 seconds).
- Resend Login Link Delay (seconds): Minimum wait time before a customer can request a new login link (default: 30 seconds).
- Default Email Account: The SMTP email account used for sending OTP codes and login links.
Note: This setting supports multi-store configuration, allowing you to configure each setting separately for each store using the override checkboxes.
Login with OTP
The OTP Login feature allows customers to log in using a one-time password sent to their registered email address, without needing to enter their account password.
· On the login page, click the Login with OTP button.
· Enter your registered email address and click Send OTP.
· Check your email inbox for the OTP code. Enter the 6-digit OTP code on the verification page and click Verify and Login.
Upon successful verification, you will be automatically logged in and redirected to the store.
Note: The OTP code expires after the configured time (default: 5 minutes). If it expires, you can click the Resend OTP button once the countdown timer completes.
Login with Link
The One-Time Login Link feature allows customers to log in by clicking a unique link sent to their email, providing a password-free login experience.
· On the login page, click the Login via Link button.
· Enter your registered email address and click Send link.
A confirmation page will appear asking you to check your email. Open your email inbox and click the login link.
Upon clicking the link, you will be automatically logged in and redirected to the store.
Note: The login link expires after the configured time (default: 15 minutes) and can only be used once. If it expires, you can click the Resend Link button once the countdown timer completes.
Managing Logged-in Devices
The Device List feature allows customers to view all devices they are currently logged in from, including browser information, IP address, and last login time.
· Navigate to My Account → Logged In Devices.
The logged-in devices table shows:
· Serial #: Row number.
· Browser Info: Browser and operating system details (e.g., "Chrome on Windows 10").
· IP Address: The IP address from which the login occurred.
· Last Login: Date and time of the most recent login from that device.
The current session is marked with a badge for easy identification.
Troubleshooting
OTP login or login with link buttons are not appearing
· Ensure the Advanced Authentication plugin is installed and enabled.
· Verify that Enable OTP Login and/or Enable One-Time Login Link are checked in the plugin configuration.
· Navigate to Admin → Configuration → Local plugins.
· Locate the Nop Advanced Authentication plugin (Group: All/Nop-Station).
· Click on Edit button of this plugin and ensure it is marked as Enabled.
Emails not being sent
Navigate to Admin → Configuration → Email accounts and verify your SMTP settings are correctly configured
In the plugin configuration, ensure a valid Default Email Account is selected.
Check the System Log (Admin → System → Log) for any email sending errors.
