Title: Sendity Author: Christian Schätzlein Published: August 4, 2026 Last modified: August 4, 2026 --- Search plugins ![](https://ps.w.org/sendity/assets/banner-772x250.png?rev=3633896) ![](https://ps.w.org/sendity/assets/icon-256x256.png?rev=3633896) # Sendity By [Christian Schätzlein](https://profiles.wordpress.org/dachscon/) [Download](https://downloads.wordpress.org/plugin/sendity.0.1.0.zip) * [Details](https://wordpress.org/plugins/sendity/#description) * [Reviews](https://wordpress.org/plugins/sendity/#reviews) * [Installation](https://wordpress.org/plugins/sendity/#installation) * [Development](https://wordpress.org/plugins/sendity/#developers) [Support](https://wordpress.org/support/plugin/sendity/) ## Description Sendity connects WordPress to Sendity Cloud or your own Sendity server. It provides a `Sendity Login` editor block and `[sendity_login]` shortcode, can appear on `wp- login.php`, and validates signed Sendity authorizations before starting a normal WordPress session. #### Features * Bundle Sendity Client 0.3.2 locally; no runtime CDN or remote JavaScript. * Discover public signing keys through JWKS discovery using the WordPress HTTP API. * Require a valid signature, issuer, audience, pairwise subject, separate auth- request/token IDs, expiry, auth time, AMR/channel, and standard verified email or phone claims. * Reject replayed or oversized login tokens. * Create or reuse low-privilege WordPress users only for verified email identities. * Support verification-only apps, including apps that verify phone numbers, without creating WordPress users or sessions. This plugin is a WordPress integration, not a Sendity server. #### External services By default, this plugin connects visitors’ browsers to Sendity Cloud, an external verification service operated by Dachs Consulting GmbH. A site administrator can instead configure a self-hosted Sendity server. When verification starts, the browser sends the Sendity App Public Key, site origin, localized interface templates, and transport configuration to the configured Sendity server. Normal web requests also disclose technical data such as the visitor’s IP address and user agent. The visitor then sends the displayed code through the configured channel, which may disclose the email address or phone number being verified to that Sendity service and the relevant email or telecommunications provider. Short- lived authentication request data, including the request ID and client secret, is stored in browser session storage for the flow. For WordPress login apps, Sendity returns a signed authorization containing the verified email address and potentially profile data supplied through the verification channel. The plugin fetches public signing keys from the configured JWKS endpoint, verifies the authorization locally, prevents replay, creates or reuses the WordPress user, and stores verification metadata as user meta. WordPress passwords and administrator credentials are never sent to Sendity. For Sendity Cloud: * Terms of Service: https://sendity.io/terms * Privacy Policy: https://sendity.io/privacy * Service website: https://sendity.io For a self-hosted Sendity server, that operator’s terms and privacy policy apply. #### Source code and bundled assets WordPress integration source: https://gitlab.com/sendity/integrations/wordpress Bundled Sendity Client source: https://gitlab.com/sendity/client/custom-element/-/ tree/v0.3.2 The release ZIP includes the generated browser bundle so WordPress does not need Composer, npm, or an external CDN at runtime. Exact source revision, checksum, build command, license, and dependency notices are included in `assets/sendity-client/ SOURCE.md` and `assets/sendity-client/THIRD-PARTY-NOTICES.md`. ### Configuration Important options under `Settings -> Sendity`: * Sendity App Public Key: the public key from the Sendity app settings. * App Purpose: `WordPress login (email)` or `Verification only` for apps such as phone verification. * Show on wp-login.php: available for WordPress login apps. * Create WordPress Users: create a low-privilege user after verified email login; enabled by default. * Default Role for New Users: defaults to `subscriber`; privileged roles are unavailable. * Login Redirect: defaults to `/`. * Server URL: defaults to `https://sendity.io/api`; change only for a self-hosted server. * JWKS URL Override: optional; leave empty for automatic JWKS discovery. * Transport: `Auto` is recommended. * Replay TTL: how long used authorizations are remembered. Constants such as `SENDITY_SERVER_URL`, `SENDITY_ISSUER`, `SENDITY_AUDIENCE`, `SENDITY_APP_PUBLIC_KEY`, and `SENDITY_JWKS_URL` may be defined in `wp-config.php`. ## Screenshots [⌊Sendity settings page in the WordPress admin.⌉⌊Sendity settings page in the WordPress admin.⌉[ Sendity settings page in the WordPress admin. [⌊Sendity Login editor block or shortcode on a page.⌉⌊Sendity Login editor block or shortcode on a page.⌉[ Sendity Login editor block or shortcode on a page. [⌊Optional Sendity integration on the default WordPress login form.⌉⌊Optional Sendity integration on the default WordPress login form.⌉[ Optional Sendity integration on the default WordPress login form. ## Blocks This plugin provides 1 block. * Sendity Login ## Installation 1. Install and activate Sendity from `Plugins -> Add New`, or upload the plugin ZIP. 2. Open `Settings -> Sendity`. 3. Paste the Sendity App Public Key. 4. Select the App Purpose that matches the Sendity app. 5. Add the `Sendity Login` block or `[sendity_login]` shortcode. For email login apps, you may also enable `wp-login.php` integration. ## FAQ ### How do I add Sendity to content? Add the `Sendity Login` block, or use `[sendity_login]`. Presentation attributes remain available, for example `[sendity_login variant="modal" position="top" sendity_border_radius ="1.25rem"]`. Security-sensitive server URL, public key, and transport values always come from plugin settings and cannot be overridden by shortcode content. ### Can a phone-verification app create WordPress users? No. Select `Verification only` as the App Purpose and disable session handoff for that app in Sendity. The block or shortcode can perform verification, but the plugin suppresses `wp-login.php`, user creation, and WordPress session handoff. WordPress login mode also rejects any signed result whose verified identifier and channel are not email. ### How are WordPress users created? Only a signed result for a verified email identity can create a user. The token must pass signature, issuer, audience, expiry, subject, token-ID, key, and replay checks first. The default role is `subscriber`; privileged roles are not offered. Disable user creation to allow existing users only. ### Can I use my own Sendity server? Yes. Configure the Server URL and, if needed, the JWKS URL. Your server must issue authorizations compatible with the documented Sendity contract. ### Does Sendity receive WordPress passwords? No. Sendity performs channel verification. WordPress verifies the signed result and uses WordPress core APIs for users, roles, cookies, and sessions. ### How are translations provided? The plugin and bundled client contain English source and fallback strings only. All settings, block editor, login errors, accessibility labels, and visitor-facing Sendity interface strings use the `sendity` text domain. After publication, WordPress. org generates and distributes community language packs from translate.wordpress. org. No translation catalog or separate client translation pack is bundled in the plugin ZIP. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Sendity” is open source software. The following people have contributed to this plugin. Contributors * [ Christian Schätzlein ](https://profiles.wordpress.org/dachscon/) [Translate “Sendity” into your language.](https://translate.wordpress.org/projects/wp-plugins/sendity) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/sendity/), check out the [SVN repository](https://plugins.svn.wordpress.org/sendity/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/sendity/) by [RSS](https://plugins.trac.wordpress.org/log/sendity/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.1.0 * Initial WordPress.org release with Sendity Client 0.3.2. * Add block, shortcode, and optional `wp-login.php` integration. * Add signed authorization verification, JWKS discovery, and replay protection. * Add explicit verification-only mode for non-email apps. ## Meta * Version **0.1.0** * Last updated **13 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.5 or higher ** * Tested up to **7.0.2** * PHP version ** 8.1 or higher ** * Tags * [authentication](https://wordpress.org/plugins/tags/authentication/)[email](https://wordpress.org/plugins/tags/email/) [login](https://wordpress.org/plugins/tags/login/)[passwordless](https://wordpress.org/plugins/tags/passwordless/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/sendity/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/sendity/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/sendity/reviews/) ## Contributors * [ Christian Schätzlein ](https://profiles.wordpress.org/dachscon/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/sendity/)