İletiniz SMS

İletiniz SMS connects your WordPress site to iletiniz using the OAuth 2.0 Authorization Code flow (with PKCE) and turns your store into a complete SMS application. iletiniz is a hosted messaging service that sends SMS (and other channels, such as WhatsApp/Telegram, depending on your connected provider) through your own approved sender IDs and provider accounts.

Features:

• Secure one-click connection via OAuth (no API key or password to type in), with workspace selection.
• Dashboard: connection status, plan and remaining quota, connected SMS providers and approved sender IDs.
• WooCommerce automation: when an order status changes (received, processing, shipped, cancelled, refunded, etc.) an automatic, templated SMS is sent to the customer.
• Bulk sending: send a personalized bulk SMS to your WooCommerce customers in one go (filtered by order status and date).
• Plan/quota gate: when your quota runs out or you have no active plan, the plugin links you directly to iletiniz to upgrade.
• The API key is stored encrypted on your server (Libsodium/AES); least-privilege scope principle.
• Disconnect (revoke) support.

Authorization scopes: messages:send, contacts:write, connections:read, account:read.

This plugin requires a (free or paid) account at iletiniz. Sending messages consumes the quota of your iletiniz plan.

External services

This plugin connects to the third-party iletiniz service, operated by İletiniz, to provide all of its messaging functionality. iletiniz is the SMS/messaging provider behind the plugin; without it the plugin cannot send messages or display account information. Two iletiniz endpoints are used:

1. iletiniz API – api.iletiniz.com

This is the service that actually sends your messages and returns your account/sender data. It is contacted in the following cases:

• When a WooCommerce order changes status and the matching notification is enabled — to send the order SMS. Data sent: the customer's phone number, the rendered message text, and (optionally) the selected sender ID and provider code.
• When you run a bulk send from the "Bulk Sending" page — to send the messages. Data sent: the recipient phone numbers and the rendered message text for each recipient, plus the optional sender ID and provider code.
• When the Dashboard, WooCommerce, or Bulk Sending pages load — to read your plan/quota (/v1/account) and your approved senders/connections (/v1/senders). No personal data is sent in these read requests.

Every request includes your iletiniz API key as a Bearer token so the service can authenticate your account.

2. iletiniz web app / authorization server – iletiniz.com

This is used only to connect and disconnect your site (OAuth 2.0 with PKCE). It is contacted in the following cases:

• When you click "Connect to iletiniz", you are redirected to iletiniz.com to log in and authorize the connection. After authorization, the plugin exchanges the returned authorization code for an API key at /connect/token. Data sent: the authorization code, the PKCE code verifier, the client id (wordpress), and the redirect URL.
• When you disconnect, the plugin calls /connect/revoke to revoke the credentials on the iletiniz side. Data sent: the client id and the API key being revoked.

Use of these services is subject to the iletiniz Terms of Use and Privacy Policy:

• Terms of Use: https://iletiniz.com/kullanim-sartlari
• Privacy Policy: https://iletiniz.com/gizlilik-politikasi