Description
Press Connect to Wakit and a window opens on Wakit. Put in your mobile
number, confirm the code that arrives on WhatsApp — an account is created there
and then if you do not have one — and choose which workspace pays for messages
and which approved template this site may send on. Approve, and the window
closes on your WordPress screen with the workspace, the balance and the template
already filled in.
Then:
- Templates. See every template you can send on, write a new one, and watch
it move from review to approved without leaving WordPress. - Order notifications. When an order moves to Processing, Completed or any
other status, the customer gets a WhatsApp message. Each status picks its own
template and its own variables, built from merge tags like{full_name}and
{order_number}. - Sign in with WhatsApp. A
[wakit_otp_login]form takes a mobile number,
sends a code, and signs the matching account in. It also appears under the
usual login box onwp-login.php. - Sign in to wp-admin with a mobile number. Switch on wp-admin sign-in and
administrators and shop managers can use the same form: number, code from
WhatsApp, straight to the screen they were asking for. Each of those accounts
puts its number on its own profile, under Sign in with WhatsApp. - Your WhatsApp numbers. The dashboard shows the Cloud API numbers on your
Wakit workspace, which one your customers see the message arrive from, and
whether it can send today. Connect a new one on Wakit — the button gets you
there already signed in — and it appears here on the next look. - Send log. Every attempt, successful or not, with what Meta said about
the failures.
Two kinds of account, and why the screens differ
You have your own WhatsApp Business number. You own that account, so every
template on it is yours, and a new one goes straight to WhatsApp for approval.
You are on Wakit’s shared number. You send from a number other businesses
also send from, so you use the templates Wakit has assigned to you — never
anybody else’s, and nobody else ever sees yours. A template you write is read by
Wakit before WhatsApp is shown it: on a shared number, WhatsApp holds everyone
to what any one of them sends.
What the site can and cannot do
This site can only send templates the workspace already has. Naming anything
else is refused by Wakit, not by the plugin — so a compromised WordPress install
cannot invent a message to send, and a plugin added here never widens what may
go out from a workspace.
The API key is swapped for on the server, never travels through a browser, and
is stored encrypted with a key that lives in wp-config.php. A database dump on
its own is not a working credential.
External services
This plugin connects your site to Wakit (https://wakit.in), which is the service
that actually delivers the WhatsApp messages. Without a Wakit account the plugin
cannot send anything, so using this plugin means using that service.
Everything below is sent from your server to https://wakit.in/api/v1 over
HTTPS, signed with the API key this site was given when you connected it.
- Connecting the site. Pressing “Connect to Wakit” opens
https://wakit.in/connect/authorize in a window and gives it this site’s
wp-admin address to come back to. When you approve there, the one-time code
that comes back is exchanged at/connect/exchangefor an API key. Nothing
about your WordPress users is part of this step. - Sending a WhatsApp message. When an order reaches a status you have
switched on, the plugin posts to/messages/template: the customer’s mobile
number in international format, the name of the approved template to send, and
the values you mapped into that template’s variables — usually the customer’s
name and the order’s number, total and status. A test send does the same with
the number you type in. - Signing in with a code. The sign-in form posts the mobile number typed
into it to/otp/send, then that send’s id together with the code the visitor
typed to/otp/verify. - Reading your account. The admin screens fetch
/account,/connect/me,
/numbers and/templatesfor your wallet balance, the WhatsApp numbers on
your workspace and the templates you may send on. Writing a template posts its
name, language, category and text to/templates. Opening Wakit from a button
in wp-admin asks/connect/ssofor a one-time signed-in link.
Nothing is sent anywhere until you connect the site, and no customer data is
sent until you switch on a feature that needs it.
Wakit’s terms of service: https://wakit.in/terms
Wakit’s privacy policy: https://wakit.in/privacy
Installation
- Upload the
fastkit-otp-authentication-notifications-for-woocommercefolder to
/wp-content/plugins/, or install the zip from
Plugins Add New Upload. - Activate it.
- Go to Wakit and press Connect to Wakit.
Your site must be on HTTPS. Wakit refuses to send the connect code back over
plain http, where it would travel in clear text — the one exception is a site
running on localhost for development.
To point at a self-hosted Wakit, define this in wp-config.php before the
plugin loads:
define( 'WAKIT_BASE_URL', 'https://wakit.example.com' );
FAQ
-
Nothing arrives, but the log says “Sent”.
-
“Sent” means Meta accepted the message. Delivery after that depends on the
number having WhatsApp and not having blocked the sender. Open the Wakit
dashboard to follow a specific message. -
A send fails with “template name does not exist”.
-
The template was approved on a different WhatsApp number than the one the
workspace now sends from. Reconnect from the Wakit screen and pick it again. -
Sends fail after I changed the number of variables.
-
Meta counts the variables and rejects a mismatch. The template decides how many
there are — fill in exactly that many rows and leave the rest blank. -
Can an administrator sign in to wp-admin with a code?
-
Yes, but two things have to be true, and neither happens on its own. Tick
wp-admin sign-in under Wakit OTP sign-in, and put the mobile number on
the account itself — Users Profile Sign in with WhatsApp. An
administrator usually has no billing address, so without that field there is no
number to match and the form will say no account uses it.It is off by default for a reason. A phone number that reaches an account which
can edit the whole site is a much bigger thing to hand over than one that
reaches a customer account: whoever holds that SIM, or can have it reissued,
holds the site. -
I signed in with a code and landed on the shop’s account page, not wp-admin.
-
Fixed in 1.1.0. The form now carries the page you were sent to the login screen
from, and anyone who can edit posts or orders is taken to wp-admin by default.
The destination is checked on the server, so a link cannot use the login form to
bounce you off to another site. -
Two accounts have the same mobile number.
-
Only one can keep it. The profile field refuses a number that already signs in
another account, and names the account holding it — the sign-in form has to be
able to say which account a code belongs to. -
A customer’s number keeps changing back after checkout.
-
A number typed on the profile screen is fixed to the account and a later
checkout no longer moves it. A number that was only ever copied from the billing
address still follows the billing address; the profile screen says which of the
two you are looking at. Clear the field to go back to following billing. -
Someone could spam the sign-in form and spend my balance.
-
An unknown number is turned away before anything is sent, and each number and
each address is capped per hour. Switching on “create an account for a number
that does not have one” removes the first of those protections, which is why it
is off by default. -
I deleted the plugin. Is the key gone?
-
The copy stored here is deleted on uninstall. The key itself stays live on
Wakit until you revoke it there, under API keys. -
Where did my template go?
-
Check Templates. “Waiting for Wakit” means it is in their review queue;
“With WhatsApp” means it has been passed on and they are reading it. A refusal
from either shows the reason on the row. -
I wrote “order_update” but the list shows something longer.
-
On Wakit’s shared number a name is claimed once for everyone, so your account
name goes in front of yours. Nobody else can then take it, and you can tell your
templates apart from the rest at a glance.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Fastkit OTP Authentication & Notifications for WooCommerce” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Fastkit OTP Authentication & Notifications for WooCommerce” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.8
- A mobile number can only become an account on a site that is open to new
accounts. “Create an account for a number that does not have one” now does
nothing on its own: WordPress’s own Settings General Membership Anyone
can register has to be ticked as well, so this plugin cannot become a second
way in past a door the site has shut. - The roles that setting may create an account in are now decided by what a
role is allowed to do rather than by what it is not. Only a role that grants
nothing beyond reading the site — what a subscriber and a WooCommerce
customer have — is offered, so a role added by another plugin cannot slip
through on a capability this plugin had not heard of.
1.2.7
- The name now starts with Fastkit — “Fastkit OTP Authentication &
Notifications for WooCommerce” — so that it names a particular plugin rather
than describing a category of them. Same plugin, same people behind it.
1.2.6
- The plugin is no longer called “Wakit”. Nothing about how it works has
changed, and it is still built and run by Wakit — the name is the one the
WordPress plugin directory will list it under. A site that had the old plugin
installed keeps its connection, its templates and its send log: the settings
live in the database, not in the folder the plugin sits in.
1.2.5
- A mobile number can no longer become an account that can change the site.
“Role for new accounts” now offers only roles that cannot write, upload or
administer anything, and the role is checked again at the moment the account
is created — so a site that had picked something more powerful stops handing
it out. - The page that closes the connect popup takes its styles and its script from
files like every other screen, rather than printing them into the page.
1.2.4
- First release on the WordPress plugin directory. On the Plugins screen the
plugin is now simply “Wakit”, and updates come from wordpress.org the same
way they do for every other plugin there. - The readme now sets out exactly what this site sends to Wakit, when, and
under whose terms — see “External services”.
1.2.3
- Updates arrive the ordinary way. WordPress offers a new Wakit release on the
Plugins screen with “update now”, a changelog behind View details, and
auto-updates if the site has them on — no more downloading a zip and
uploading it by hand.
1.2.2
- Order notifications is one status at a time. The statuses are a list down the
side, each marked when it is switched on, and only the one being edited is
open — rather than eight cards stacked into a page nobody could see the end
of. Nothing is hidden from the save: every status still posts, so switching
between them never loses what was typed. - Template variables sit two or three across instead of one per row, and the
merge tags are two short columns rather than one long table.
1.2.1
- Fixes an install that failed on activation with “Plugin file does not exist.”
The 1.2.0 zip was packed with the wrong path separator, so WordPress unpacked
it into files it could not then find. Nothing inside the plugin changed. - The plugin’s own screens are now Wakit green rather than WordPress blue, so
they match the Wakit tab the connect button opens. The WhatsApp sign-in form
is painted to match too, on wp-login.php and wherever the shortcode is used. - Templates now says what to do about it when you are on Wakit’s shared number:
add your own WhatsApp Business number, get the business behind it verified,
and write templates in your own words. The button that starts it is on the
screen rather than somewhere on Wakit you have to go looking for.
1.2.0
- The dashboard now shows the WhatsApp Cloud API numbers on your Wakit
workspace, which one your messages actually leave from, and whether it may
send today. Connect a number on Wakit and it appears here on the next look —
nothing to copy across. - Every link out to Wakit signs you in on the way: the dashboard, your numbers,
connecting a new number, and recharging are each one click, with no second
sign-in.
1.1.0
- Sign in to wp-admin with a mobile number and a WhatsApp code.
- A mobile number on the user profile, so an account with no billing address —
every administrator — can be reached by the sign-in form. It is fixed to the
account: a later checkout no longer moves it, and no two accounts may share
one. - Signing in now returns to the page you came from, and sends anyone who works
on the site to wp-admin rather than the shop’s account page.
1.0.0
- One-click connect: mobile number, WhatsApp code, workspace and template.
- Write your own templates and follow them through review to approved.
- WooCommerce order notifications, a template and variables per status.
- Sign in to WordPress with a WhatsApp code.
- Send log, test send, and a one-time link into the Wakit dashboard.