內容簡介
ZapQR Login 提供無密碼登入功能，讓使用者透過 ZapQR 帳號輕鬆登入 WordPress 網站，增強安全性並簡化使用流程。
【主要功能】
• 支援 ZapQR 單一登入（SSO）
• 使用 WebAuthn 進行防釣魚的登入
• 自動填寫登入表單的 QR 碼功能
• 低權限角色創建新訪客
• 單一登出功能
外掛標籤
開發者團隊
原文外掛簡介
ZapQR Login gives your WordPress site passwordless sign-in, two ways:
Sign in with ZapQR (SSO) — recommended
A “Sign in with ZapQR” button on your login page. Visitors sign in with their ZapQR account — passkey-first (Face ID / Touch ID / security key), with an email link as fallback — via standards-based OpenID Connect single sign-on. One ZapQR account works across every site that offers it.
Passkey-first: phishing-resistant WebAuthn sign-in, no passwords anywhere
Standards-based: OAuth 2.0 authorization-code flow with PKCE; ID tokens verified in the plugin (RS256, JWKS)
Links existing WordPress users by their verified email — admins keep their role
New visitors are created with a low-privilege role you choose (Subscriber by default)
Single logout: logging out of WordPress also ends the ZapQR session
No external code: the whole flow is server-side redirects and server-to-server calls
QR credential fill (classic)
Users save their WordPress credentials in the ZapQR app; on the login page they scan a QR code and the login form fills and submits itself. Credentials travel phone → browser over an encrypted WebSocket relay and are never stored on external servers.
External services
This plugin talks to the following services. No data is sent anywhere until a site administrator enables the relevant mode.
ZapQR identity provider (SSO mode) — auth.zapqr.ai by default, or a self-hosted issuer the admin configures. When a visitor clicks “Sign in with ZapQR” their browser is redirected there to authenticate; your server then exchanges an authorization code (server-to-server) and receives the visitor’s email address and its verified status — nothing else. Provider: DaSecure (zapqr.ai, terms and privacy linked there).
ZapQR relay (QR mode) — wss://relay.zapqr.ai, a WebSocket relay that pairs the login page with the visitor’s phone using a random session identifier. Credentials pass through end-to-end encrypted and are not stored. Provider: DaSecure (zapqr.ai).
QR image service (QR mode) — api.qrserver.com renders the QR image. It receives only the random session identifier and your site’s hostname — never credentials. Provider: goqr.me (privacy).
