Enable/Disable OTP

OTP Login lets customers log into a store using their phone number instead of (or in addition to) email and password.

Enable OTP Login

Toggle Enable OTP Login ON. A confirmation dialog appears before the change is committed, and the setting can be reversed at any time. A provider must be configured and activated first (see Admin Configuration).

To disable, return to the same toggle and switch it OFF.

How It Works for Customers

1. Customer visits the OTP login page (/otp/login on the tenant storefront).
2. Customer enters their phone number.
3. The system generates a 6-digit OTP and sends it via SMS.
4. Customer enters the OTP on the verification page.
5. If the OTP is correct and not expired, the customer is logged in.
6. The OTP is immediately deleted after use (single-use only).
7. If the OTP expires, the customer clicks Resend to get a new one — resending invalidates the old code.

Requirements and Security

• The phone number must match a registered customer account with a valid phone number in the profile.
• OTPs are 6 digits, randomly generated, and single-use.
• Expiry is configurable (1–30 minutes; 5 minutes recommended) — set it under Settings → OTP Expiry Time.
• Customize the OTP message text under SMS Options → Templates. See Message Templates.