Authyo OTP for Easy Form Builder

Yes. You need a free Authyo account and a Client ID / Client Secret pair to send OTPs via Email, SMS, WhatsApp, or Voice Call. Visit https://app.authyo.io/account/welcome?ref=H.TA64CC59&utm_source=partner&utm_medium=referral&utm_campaign=partner-program to create your account and get started.

No. This plugin works with the standard Email and Phone fields Easy Form Builder already provides - just build your form normally. Once a channel is turned on in the Authyo settings, OTP verification is active automatically on every form that has a matching field.

Only after an administrator has saved a valid Authyo Client ID and Client Secret in the plugin settings. Until then the plugin is completely dormant: it adds nothing to your pages, calls no external service, and every Easy Form Builder form keeps submitting exactly as it did before the plugin was installed. The same applies if the saved credentials can no longer be read (for example after the WordPress security salts in wp-config.php are changed) - forms keep working without OTP, and a warning is shown in the WordPress admin asking you to re-enter the credentials.

Yes. The Forms tab lists every Easy Form Builder form with an on/off switch, so you can disable OTP for an individual form - useful while building or testing it - without affecting any other form or your site-wide channel settings. Forms default to OTP-enabled until you switch one off.

The plugin includes a smart fallback: when a visitor requests an OTP and Authyo reports that your wallet balance is exhausted, the field is automatically marked as verified so genuine users are not blocked, and the site admin receives an email alert (at most one per hour) until the balance is topped up. This is an intentional safety mechanism to prevent lead loss. It only applies when Authyo answers the request - if the service cannot be reached at all, the visitor is shown an error and can retry, and the form is not submitted unverified.

Yes. The plugin includes a "Visitor Choice" option that lets users pick their preferred OTP delivery method - SMS, WhatsApp, or Voice Call - directly on the form.

Authyo OTP for Easy Form Builder supports four channels: Email, SMS, WhatsApp, and Voice Call. Please note that Voice Call OTP works only on Indian phone numbers as of now. You can enable one or multiple channels site-wide from the Verification Methods tab.

It is built with the usual safeguards: API credentials are stored encrypted (AES-256-CBC via the PHP OpenSSL extension, keyed from your site's WordPress security salts), every OTP endpoint is rate limited, and a server-side verification gate is enforced independently of the visitor's browser, so it is not bypassed by disabling JavaScript. For email fields the gate also checks that the address submitted is the one that was verified; for phone fields it checks that the visitor completed verification for that form and channel. Some things worth knowing: (1) Easy Form Builder does not hand a token to the server when a form is submitted, so a completed verification is remembered per visitor connection (the IP address - for IPv6 the /64 network - or the logged-in user), form and channel for up to 30 minutes, and is tied to the exact email address or phone number that was verified; visitors who share one connection are therefore treated as one visitor for that window. (2) Credentials are encrypted with OpenSSL; on the rare server without the OpenSSL extension they can only be Base64-encoded, which is not encryption. (3) The server-side check depends on Easy Form Builder's current submission endpoint; if an Easy Form Builder update changes it, this plugin shows an admin notice and, so that genuine leads are never lost, lets submissions through until the plugin is updated. No security measure is absolute, so keep WordPress, Easy Form Builder and this plugin up to date.

Rate limits are tracked per visitor using the IP address WordPress sees. Most hosts and CDN integrations already pass the real visitor address through; if yours does not (every visitor appears to share the proxy's address), a developer can return the real address via the authyo_efb_remote_ip filter; for logged-in visitors the overall per-visitor limit is tracked by user account instead of by address.

While OTP verification is active, pages that show an Easy Form Builder form are automatically marked as not cacheable (the standard DONOTCACHEPAGE signal that every major caching plugin honours), so the OTP panel is always served fresh. Pages without a form are not affected. One thing to remember: if you turn OTP on for a form, or enable a channel, after that page was already cached, clear your caching plugin's cache once so visitors get the updated page.

No. Email addresses and phone numbers are sent to Authyo only to deliver and check the one-time code, and are never saved by this plugin. On your own site it keeps only short-lived (30 minutes maximum), salted, non-reversible hashes - of the visitor's IP address, for rate limiting, and of the verified value, so the submitted value can be matched to the one that was verified. These hashes cannot be turned back into the original data, so there is nothing for the WordPress personal-data export or erasure tools to find. Your visitors' submissions themselves are stored by Easy Form Builder exactly as they were before this plugin was installed.

Yes. A country selector is added next to each phone field, using the list of countries Authyo supports (downloaded from Authyo and refreshed weekly). You can display all countries, a filtered selection, or a single country - ideal for region-specific forms.

Yes. Authyo is an official partner of Easy Form Builder by WhiteStudio. This integration is developed and supported by Authyo (Konceptwise) in partnership with WhiteStudio as the partner OTP integration for Easy Form Builder.

Yes. On the General tab, under API Credentials, click "Remove saved keys" and confirm. Your Client ID and Client Secret are deleted from your site, the downloaded country list is cleared, and OTP verification switches off on all forms until you add new keys. Your other settings are kept.

If you want support, you can connect with the Authyo support team by filling out the form at https://authyo.io/support/ . Visit https://authyo.io/ for documentation and tutorials.