WordPress integration
Use Sendity in WordPress.
The Sendity Login plugin renders the browser Client, verifies signed results inside WordPress, rejects replay and creates normal WordPress authentication cookies for verified email identities.
In WordPress, open Plugins → Add Plugin, search for Sendity, then choose Install Now and Activate. You can also install the published plugin with WP-CLI. Bedrock projects may use Composer instead.
wp plugin install sendity --activate
# Bedrock / Composer alternative
composer require wp-plugin/sendity:^0.1Configure Sendity
Create or open your app in Sendity Cloud, add the WordPress origin, and copy its public app id. Then open Settings → Sendity in WordPress. Cloud installations normally need only the public app id and app purpose; key discovery and verification use the hosted defaults.
| Setting | What it controls |
|---|---|
| Sendity App Public Key | The public app id from Sendity Cloud. It also becomes the expected token audience unless you lock in a separate advanced value. |
| App Purpose | WordPress login (email) creates a WordPress session; Verification only renders the proof flow without creating users or login cookies. |
| Show on wp-login.php | Adds Sendity to the standard WordPress login screen for email-login apps. |
| Create WordPress Users | Creates a low-privilege user after a verified email login. Disable it to allow existing users only. |
| Default Role for New Users | Selects the low-privilege role assigned to users created by Sendity. Privileged roles are excluded. |
| After Login Redirect | Sets the local destination after WordPress has accepted the signed result and created its session. |
| Sendity Server URL | Defaults to Sendity Cloud. Change it only when you operate a compatible Sendity server. |
| JWKS URL Override | Overrides automatic signing-key discovery. Leave it empty for Sendity Cloud. |
| Transport | Auto is recommended; polling and push are explicit fallbacks for constrained environments. |
| Replay TTL | Controls how long a used authorization token is remembered and rejected as a replay. |
Self-hosted or managed deployments can lock verifier values in wp-config.php. Do not put private Sendity credentials into posts, blocks, or shortcodes.
define('SENDITY_SERVER_URL', 'https://sendity.io/api');
define('SENDITY_ISSUER', 'https://sendity.io');
define('SENDITY_AUDIENCE', 'app_01HX...');
define('SENDITY_APP_PUBLIC_KEY', 'app_01HX...');
define('SENDITY_JWKS_URL', 'https://sendity.io/api/.well-known/jwks.json');Use the Gutenberg block
In the block editor, add Sendity Login. The editor shows a safe demonstration; the published page uses the app configured under Settings → Sendity.
| Block option | Values | Description |
|---|---|---|
| Layout variant | Card, Modal | Card embeds the complete flow in the page. Modal renders it as an overlay. |
| Position | Center, Top, Bottom | Places the modal vertically. It has no effect on the Card variant. |
| Preview state | Challenge, Warning, Expired, Verified, Error | Changes only the editor preview so you can inspect each state; it never changes the live authentication result. |
| Border radius | CSS length, for example 1.25rem | Overrides the Sendity component corner radius for this block instance. |
Use the WordPress shortcode
Use the canonical [sendity_login] shortcode in a Shortcode block, classic editor, widget, reusable pattern, or compatible page builder. The published plugin does not register a [sendity] alias.
[sendity_login]
[sendity_login variant="modal" position="top" sendity_border_radius="1.25rem"]| Attribute | Description |
|---|---|
variant="modal" | Uses the modal overlay. Omit the attribute for the default embedded card. |
position="top|center|bottom" | Sets the modal position and is ignored unless variant is modal. |
sendity_border_radius="1.25rem" | Sets the supported Sendity border-radius design token for this instance. |
class="my-class" | Adds your CSS class to the rendered Sendity element. |
style="..." | Adds instance-specific inline CSS, including additional Sendity design tokens generated by the Configurator. |
Public key, server URL, transport, locale translations, and token-verification policy always come from administrator settings and cannot be overridden by shortcode content.
Choose login or verification-only behavior
Email login apps can create or reuse a WordPress user and complete the same-origin handoff at /sendity/session. Verification-only apps, including phone verification, disable session handoff and do not create users or login cookies.
The plugin bundles Sendity Client 0.3.3 locally; WordPress locale packs provide translations through the Client’s host-translation contract.