Riverbox Passwordless Login

Riverbox replaces passwords with modern, frictionless login. Users sign in with a one-time code, a magic link, a passkey, or their phone number — and new visitors can get an account automatically.

Login methods

• Email one-time codes — type your address, get a short code, you’re in.
• Magic links — one-click login links by email; single-use and expiring.
• Passkeys (WebAuthn) — sign in with a fingerprint, face, or security key. Includes an account page ([riverbox-account]) where users manage their devices. No external services; the WebAuthn ceremony is verified on your own server.
• Phone one-time codes — SMS login through your own HTTP SMS gateway ({{to}}/{{message}} placeholder templates).
• Password — classic login can stay available alongside the passwordless methods.

Security

• Codes stored only as hashes, with expiry, attempt caps, and resend cooldowns.
• Per-IP and per-identifier rate limiting; responses never reveal whether an account exists.
• Magic links are single-use and blocked for accounts that require multi-factor login.
• A delivery log records every code dispatch with the raw gateway response.

Developer friendly

• REST API under riverbox/v1 (/begin, /verify, passkey endpoints) built on an extensible authentication-factor architecture — every method is a “factor”, and login flows are factor chains.
• Documented hooks: riverbox_register_factors, riverbox_login_chain, riverbox_otp_sent, riverbox_logged_in, riverbox_login_redirect, riverbox_user_created, plus settings extension points.

Riverbox Pro (sold separately at dontworry2much.com) adds Twilio and WhatsApp Cloud API gateways, social login (Google, Microsoft, Facebook, GitHub, LinkedIn, Discord), and role-based 2FA/3FA login flows.

Privacy

The free plugin does not connect to any external service. Emails go through your site’s own mail system, SMS goes through the gateway you configure, and all data stays in your WordPress database.