BlockAuth Logo
EN

WordPress

Follow this guide if your site runs on WordPress. You don't write code: the Block-Auth Login plugin does the whole integration.

1. What you get

  • A Block-Auth button on the WordPress login, or a login without passwords at all.
  • Every login is verified on your server with your API secret before WordPress creates the session.
  • WordPress users are created or found automatically, with the role you choose.
  • Sessions close in WordPress when the user signs out in Block-Auth or unlinks your site.

2. Prepare your app

  1. In the Dashboard, create your application with your site's domain and validate it, following the Integration Quickstart.
  2. Copy the apiKey and apiSecret from Applications » Show keys.

3. Install the plugin

In WordPress, go to Plugins › Add New › Upload Plugin, upload the Block-Auth Login zip and activate it. It needs WordPress 6.0 and PHP 7.4 or later.

4. Connect it

Go to Settings › Block-Auth Login, paste the API key and API secret, and press Test connection. The secret is stored encrypted. If you prefer, define the keys in wp-config.php instead:

wp-config.php

define( 'BLOCKAUTH_API_KEY', 'your_api_key' );
define( 'BLOCKAUTH_API_SECRET', 'your_api_secret' );

5. Choose the login

In the same settings page, choose how the login looks:

  • Next to the classic form: users can sign in with their password or with Block-Auth.
  • Replace the form: your site has no passwords at all.

To place the button on any page, use the [blockauth_login] shortcode. WooCommerce login forms are supported.

6. Set the webhook

Copy the signout callback URL shown in the plugin settings:

Callback URL

https://your-site.com/wp-json/blockauth/v1/signout-callback

In the Dashboard, open your application's Authentication settings. In the third URL field, shown as "When user fails to log in", type only the path /wp-json/blockauth/v1/signout-callback (your domain is already filled in). When a user signs out in Block-Auth or unlinks your site, WordPress closes their sessions.

Users who already have a WordPress account can link it to their Block-Auth identity from their profile, from WooCommerce › My Account or wherever you place the [blockauth_link] shortcode. Linking asks for a WordPress login in the last 10 minutes. After that, signing in with Block-Auth opens that same WordPress account.

You can turn linking off with Let signed-in users link their account to Block-Auth in the settings.

8. Roles and safety switch

New users get the default role you choose, and you can map Block-Auth roles to WordPress roles in the settings. If you ever lock yourself out, add this line to wp-config.php to bring back the classic login:

wp-config.php

define( 'BLOCKAUTH_DISABLE', true );