Published by Web3 Digital Wallet (Talao). This is an independent connector,\nnot an official European Union or Member State Wallet plugin. It is not\naffiliated with or endorsed by the European Union or Member State Wallet providers.\nThe plugin is free software under GPLv2 or later. Any subscription fees apply\nto the separately hosted verification service, not to unlocking plugin code.<\/p>\n\n
Adds a Wallet login button to the WordPress login form, WooCommerce login form\nwhen present, and the [eudi_wallet_login] shortcode. Authorization Code, PKCE\nS256, signed ID Token validation and browser-bound single-use state are enabled\nwithout extra security settings. PHP OpenSSL and Sodium are required.<\/p>\n\n
Existing accounts are never matched or merged by email. Users can link their\nWallet from their own WordPress profile after confirming their local password.\nNew account creation is disabled until the administrator explicitly enables it.\nNew users receive Subscriber, or Customer if that role exists and is selected.\nNo administrator roles are issued by this plugin.<\/p>\n\n
Follow the setup using recorded test interfaces and fictional data. These\ninstallation tutorials do not demonstrate a complete real Wallet authentication.\nThey use AI-generated narration and have no supplied subtitle tracks.<\/p>\n\n
WordPress installation and configuration (English):<\/p>\n\n
https:\/\/www.youtube.com\/watch?v=zNpBIHgp8kc<\/p>\n\n
Create your EUDI Wallet connection (English):<\/p>\n\n
https:\/\/www.youtube.com\/watch?v=tHwmMXqMi5k<\/p>\n\n
French tutorials:\nWordPress installation: https:\/\/www.youtube.com\/watch?v=v8NCgQEXTcU\nCreate your connection: https:\/\/www.youtube.com\/watch?v=Hf0SNF6U9fs<\/p>\n\n
This plugin requires an OIDC provider; the default is the EUDI OIDC Bridge at\nhttps:\/\/login.openid4vc-hub.com. Saving settings alone makes no provider request.\nStarting Wallet login contacts its Discovery endpoint; completing login exchanges\nthe code server-side, fetches JWKS and UserInfo. The provider receives the client\nID, registered callback, requested scopes, random state\/nonce\/PKCE challenge and\nclient authentication at the token endpoint. Identity verification is handled by\nthe provider and the Wallet. WordPress receives only authorized OIDC attributes.\nContact email, when requested, is verified separately by the bridge after identity verification.<\/p>\n\n
JSON import reads the downloaded credentials locally in the browser; it does\nnot upload the file to the provider. The file contains a client secret and must\nbe kept private. Imported values are saved only after the administrator selects\nSave configuration. Secrets are encrypted in WordPress storage and not redisplayed.<\/p>\n\n
The free signup button opens the provider's \/register page in a new tab; no\nWordPress password or local user information is sent by that button. The form\nrequests company\/contact details, a verified developer email, an application name,\nan exact callback URL and the identity\/age purpose. The client is created only\nafter email verification.\nNo shared client credentials, Hub API keys or tracking service are included.<\/p>\n\n
Provider privacy: https:\/\/wallet-connectors.com\/privacy\/?lang=en\nProvider terms: https:\/\/wallet-connectors.com\/terms\/?lang=en\nReview service availability, quotas and applicable terms with your provider.<\/p>\n\n
The WordPress plugin is free. The default hosted verification service offers\na Free plan and an optional paid Pro subscription; payment is for the hosted\nservice, not for unlocking code or features in this plugin.<\/p>\n\n
Free includes 100 verification attempts per UTC calendar month, with a maximum\nof 10 per UTC day. Pro costs EUR 39 excluding VAT per month and includes 3,000\nverification attempts per UTC calendar month, with a maximum of 300 per UTC day.\nFailed or abandoned verification starts count toward these service quotas.<\/p>\n\n
Pro renews automatically each month until cancelled. Manage or cancel the\nsubscription through the service billing page and its Stripe customer portal.\nCancellation takes effect at the end of the paid period. Removing this plugin\nor stopping its use does not cancel the hosted subscription.<\/p>\n\n
The provider enforces the quotas. Changing the plan does not require a new\nClient ID, a new client secret or changes to the WordPress configuration.\nSubscriptions and payments take place on the service website, outside WordPress.\nSubscription availability is controlled by the service; not every Client ID is\ncurrently enabled for paid signup.<\/p>\n\n
Current plans and conditions: https:\/\/wallet-connectors.com\/pricing\/?lang=en\nManage or cancel a subscription: https:\/\/wallet-connectors.com\/billing\/?lang=en<\/p>\n\n
The client secret and temporary login data are encrypted using a key derived\nfrom the WordPress auth salt. Rotating salts invalidates encrypted data: re-enter\nthe client secret and start a new login. The EUDI_WALLET_CLIENT_SECRET constant in\nwp-config.php can hold the secret instead of the options table. Do not commit it.<\/p>\n\n
Subject associations are stored as issuer\/subject hashes linked to local user\nIDs. Account profile attributes are saved only when the account is created;\nsubsequent Wallet logins do not overwrite local names, email, roles or password.\nExpired transactions are rejected immediately and removed by hourly WP-Cron or\non the next login attempt. Deactivation clears transactions and preserves account\nassociations\/settings. No user, identity binding or settings deletion is automatic.<\/p>\n\n
Choose Age verification (18+) in the bridge signup form and plugin settings.\nThe dedicated age client uses openid age_verification and never requests email.\nOnly a signed age_over_18=true result is accepted, with matching UserInfo.\nIt opens a protected browser age session for five minutes, without creating or\nsigning into a WordPress account. The ephemeral OIDC sub is discarded.<\/p>\n\n
Age mode gates public WordPress page rendering and public REST access. Keep a\nlocal administrator login for recovery. Configure page\/CDN caches to bypass this\nsite's protected responses and the age cookie: a cache may respond before PHP.\nDirect media\/file URLs served by your web server are not protected by PHP and\nneed separate access rules. Disable or redact callback query strings in hosting\naccess logs; authorization codes must not be retained there.<\/p>\n\n
Age verification is not a regulatory compliance certification and does not prevent\nuse of a shared browser\/device. Test the complete HTTPS Wallet flow on your site\nbefore opening protected content to users.<\/p>\n\n
The connector remembers the local page from which Wallet login was started.\nCancel and return to application on the Wallet login screen first returns to the\nregistered callback; the plugin then returns to that original page with a message.\nThis also handles callback errors after state and browser validation. A missing,\nexpired or invalid transaction shows a safe recovery page instead. External return\nURLs are rejected. The registered callback remains unchanged.<\/p>\n\n
The message uses a one-time encrypted Secure\/HttpOnly cookie lasting at most two\nminutes. Configure page\/CDN caches to bypass the __Host-eudi_wp_notice cookie,\nas well as the protected age cookie. No provider error details or identity data\nare stored in that notice.<\/p>\n\n\n
The setup screen uses French or English according to your browser's language\npreferences, with English as the fallback. Manual configuration is collapsed by\ndefault. Existing saved settings are preserved. Identity mode can optionally\nrequest verified contact email and create accounts. Both options are off by default.\nFor an open identity site, enable Allow new accounts to be created and keep the\nSubscriber role. Otherwise, a verified identity without an already linked account\nis refused by WordPress even after a successful Wallet presentation. Restricted\nsites should keep account creation disabled and link accounts explicitly.\nAge mode creates no account.<\/p>\n\n
Use [eudi_wallet_member_area] for a page with distinct visitor and signed-in views.\nSigned-in users see their first name only (or a generic greeting when missing),\na profile link and a nonce-protected sign-out link. Existing local names are not\noverwritten on subsequent Wallet logins. Exclude this page from shared caches.\nThe panel reflects a WordPress session; it does not certify its login method.\nAfter a positive age verification, a one-time confirmation says \"Bravo! Your age\nhas been verified.\" Select \"Continue to the site\" to close it. The plugin returns\nto the local page that started verification; the five-minute age access remains\nactive after closing the confirmation. Without JavaScript, a status message is\nshown instead. Cancellation and failed checks never display success.<\/p>\n\n
Advanced settings contains Issuer, Callback, Scopes, Token authentication and\nnew-account role. JSON import validates the exact callback and credentials;\nchanging verification mode preserves the separate previously saved credentials.<\/p>\n\n
Documentation: https:\/\/openid4vc-hub.com\/api\/docs\/bridge.html#86-wordpress-setup\nContact: contact@talao.io<\/p>\n\n
Publisher: Web3 Digital Wallet (Talao), https:\/\/talao.io\nSource code: all runtime PHP, JavaScript and CSS is supplied in readable form\nin this package, together with Composer manifests and dependency licences.\nNo private repository access is needed to inspect or run the plugin.\nPublic source ZIP: https:\/\/wallet-connectors.com\/api\/docs\/wordpress-plugin.zip<\/p>\n\n
HTTPS is required. Local WordPress login remains available. No network-wide\nmultisite support, automatic user linking, refresh tokens or provider logout.<\/p>\n\n\n
WordPress.org preparation: escape generated HTML at output, validate and unslash\nHTTP inputs, prepare SQL table identifiers, and use a restricted safe provider\nredirect. Preserve single-use state, PKCE, account linking and encrypted storage.\nDocument justified checker exceptions for core hooks and atomic custom SQL.\nInclude Composer manifests for dependency provenance.<\/p>\n\n
Cancellation and callback errors return to the calling local page with a one-time\nmessage after browser\/state validation. Invalid or expired state uses safe recovery.\nThe settings page includes a local Talao logo linking to talao.io.<\/p>\n\n
Configuration import opens a dedicated review screen showing the imported file\nname and public settings. Saved sites reopen on the configuration screen.\nThe client secret remains hidden; import does not save settings automatically.<\/p>\n\n
Five-step setup with return URL copy and configuration JSON import. French\/English\nsetup follows browser language; manual credentials are collapsed by default.\nExisting settings, PKCE and token validation are preserved.<\/p>\n\n
Simplified active Client ID\/secret form, browser-only bridge JSON import, advanced\nOIDC settings, documentation\/contact links and preserved separate credentials.<\/p>\n\n
Development preview with isolated WordPress OIDC client and free signup access.\nAutomated tests are not proof of a complete real Wallet login.<\/p>","raw_excerpt":"Connect your WordPress site to the EUDI Wallet for sign-in or age verification.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/395597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=395597"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/thierrythevenet"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=395597"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=395597"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=395597"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=395597"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=395597"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=395597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}