內容簡介
Sendity 外掛將 WordPress 與 Sendity Cloud 或自架的 Sendity 伺服器連接，提供安全的登入驗證功能，確保使用者的身份驗證過程安全且高效。
【主要功能】
• 提供 Sendity 登入編輯器區塊與短碼
• 支援公開簽名金鑰的 JWKS 發現
• 驗證簽名、發行者與受眾等多項條件
• 拒絕重放或過大的登入令牌
• 僅為驗證過的電子郵件身份創建低權限使用者
• 支援驗證專用應用程式，不創建 WordPress 使用者
外掛標籤
開發者團隊
原文外掛簡介
Sendity connects WordPress to Sendity Cloud or your own Sendity server. It provides a Sendity Login editor block and [sendity_login] shortcode, can appear on wp-login.php, and validates signed Sendity authorizations before starting a normal WordPress session.
Features
Bundle Sendity Client 0.3.4 locally; no runtime CDN or remote JavaScript.
Discover public signing keys through JWKS discovery using the WordPress HTTP API.
Require a valid signature, issuer, audience, pairwise subject, separate auth-request/token IDs, expiry, auth time, AMR/channel, and standard verified email or phone claims.
Reject replayed or oversized login tokens.
Create or reuse low-privilege WordPress users only for verified email identities.
Support verification-only apps, including apps that verify phone numbers, without creating WordPress users or sessions.
This plugin is a WordPress integration, not a Sendity server.
External services
By default, this plugin connects visitors’ browsers to Sendity Cloud, an external verification service operated by Dachs Consulting GmbH. A site administrator can instead configure a self-hosted Sendity server.
When verification starts, the browser sends the Sendity App Public Key, site origin, localized interface templates, and transport configuration to the configured Sendity server. Normal web requests also disclose technical data such as the visitor’s IP address and user agent. The visitor then sends the displayed code through the configured channel, which may disclose the email address or phone number being verified to that Sendity service and the relevant email or telecommunications provider. Short-lived authentication request data, including the request ID and client secret, is stored in browser session storage for the flow.
For WordPress login apps, Sendity returns a signed authorization containing the verified email address and potentially profile data supplied through the verification channel. The plugin fetches public signing keys from the configured JWKS endpoint, verifies the authorization locally, prevents replay, creates or reuses the WordPress user, and stores verification metadata as user meta. WordPress passwords and administrator credentials are never sent to Sendity.
For Sendity Cloud:
Terms of Service: https://sendity.io/terms
Privacy Policy: https://sendity.io/privacy
Service website: https://sendity.io
For a self-hosted Sendity server, that operator’s terms and privacy policy apply.
Source code and bundled assets
WordPress integration source: https://gitlab.com/sendity/integrations/wordpress
Bundled Sendity Client source: https://gitlab.com/sendity/client/custom-element/-/tree/v0.3.4
The release ZIP includes the generated browser bundle so WordPress does not need Composer, npm, or an external CDN at runtime. Exact source revision, checksum, build command, license, and dependency notices are included in assets/sendity-client/SOURCE.md and assets/sendity-client/THIRD-PARTY-NOTICES.md.
Configuration
Important options under Settings -> Sendity:
Sendity App Public Key: the public key from the Sendity app settings.
App Purpose: WordPress login (email) or Verification only for apps such as phone verification.
Show on wp-login.php: available for WordPress login apps.
Create WordPress Users: create a low-privilege user after verified email login; enabled by default.
Default Role for New Users: defaults to subscriber; privileged roles are unavailable.
Login Redirect: defaults to /.
Server URL: defaults to https://sendity.io/api; change only for a self-hosted server.
JWKS URL Override: optional; leave empty for automatic JWKS discovery.
Transport: Auto is recommended.
Replay TTL: how long used authorizations are remembered.
Constants such as SENDITY_SERVER_URL, SENDITY_ISSUER, SENDITY_AUDIENCE, SENDITY_APP_PUBLIC_KEY, and SENDITY_JWKS_URL may be defined in wp-config.php.
