Customer One-Time Password (OTP) Login for Magento 2 – Passwordless Authentication

Overview

Replace passwords with secure, frictionless email-based One-Time Passwords (OTP) for your Magento 2 store. Increase conversions, reduce cart abandonment, and enhance security with our mobile-optimized passwordless login solution.

Features

• ✓ No core file modifications required
• ✓ Installed via Composer, no manual file copying
• ✓ Full, un-obfuscated source code — read every line
• ✓ Built to Magento & PSR coding standards
• ✓ 12 months of updates & support included
• ✓ See the Compatibility tab for theme & edition support

Specifications

Compatibility

• ✓ Magento Open Source (Community)
• ✓ Magento Commerce (Enterprise)
• ✓ Magento Commerce Cloud
• ✓ Magento B2B
• ✓ Magento 2.3.x
• ✓ Magento 2.4.x

Installation

1. Require the package via Composer using the key you received by email.
2. Enable the module with bin/magento module:enable.
3. Run setup:upgrade to apply the module's schema and data.
4. Flush the cache and you're done - no static content deploy needed on Hyvä.

Changelog

• v1.0.0 Aug 2025

  Changelog

  All notable changes to this project will be documented in this file.

  The format is based on Keep a Changelog,
  and this project adheres to Semantic Versioning.

  [1.0.0] - 2025-08-08

  Added

  • Initial release of MagedIn Customer One-Time Password Login module
  • Complete passwordless authentication system using email-based OTP verification
  • Secure OTP generation with cryptographically secure random number generation
  • Professional user interface with individual digit input fields and modern styling
  • Comprehensive security implementation with brute force protection and audit logging
  • Integration with Magento's native customer authentication and email systems

  Authentication Features

  • Email-Based Login: Passwordless authentication using only customer email address
  • Secure OTP Generation: 6 or 8-digit codes using Magento\Framework\Math\Random
  • Time-Based Expiration: Configurable code validity period (default: 5 minutes)
  • Single-Use Codes: Each OTP becomes invalid after successful use
  • Automatic Code Delivery: Instant email delivery with professional templates
  • Session Management: Proper session regeneration after successful authentication

  Security Implementation

  • Brute Force Protection: Automatic lockout system after configurable failed attempts
  • IP Address Tracking: Comprehensive logging of all authentication attempts with IP addresses
  • User Agent Logging: Device and browser tracking for security audit trails
  • SQL Injection Prevention: Prepared statements and proper data binding throughout
  • XSS Protection: Comprehensive output escaping in all templates and forms
  • CSRF Protection: Form key validation on all POST requests and form submissions

  User Interface

  • Modern OTP Input: Individual input fields for each digit with professional styling
  • Copy & Paste Support: Users can paste complete OTP codes with auto-distribution
  • Auto-Submit: Automatic form submission when all digits are entered
  • Responsive Design: Optimized for desktop, tablet, and mobile devices
  • Progressive Enhancement: Works with and without JavaScript enabled
  • Integration Options: Clean addon that integrates above traditional login forms

  Configuration System

  • Master Enable/Disable: Global toggle for OTP authentication functionality
  • Configurable Code Length: Choice between 6-digit or 8-digit OTP codes
  • Expiration Settings: Configurable code validity period in minutes
  • Security Parameters: Configurable maximum attempts and lockout duration
  • Redirect Options: Choice between customer dashboard or homepage after login
  • Multi-Store Support: Store-specific configuration with proper scope inheritance

  Email System Integration

  • Service Architecture: Dedicated EmailSender service with interface implementation
  • Template System: Uses Magento's native email template framework
  • Professional Templates: Branded HTML email with clear OTP display and security instructions
  • Multi-Store Email: Store-specific email configuration and sender identities
  • Template Variables: Rich set of variables for email customization and branding

  Database Schema

  • OTP Storage Table: Dedicated magedin_customer_otp table with proper indexing
  • Lockout Management: magedin_customer_otp_lockout table for security tracking
  • Performance Optimization: Strategic indexing for fast lookup and cleanup operations
  • Security Fields: IP address, user agent, and comprehensive attempt tracking
  • Status Management: Usage tracking, expiration handling, and attempt counting

  Technical Architecture

  • Service Layer Pattern: Business logic isolated in dedicated service classes
  • Interface-Based Design: All services implement contracts for flexibility and testing
  • Dependency Injection: Full DI container integration throughout the module
  • SOLID Principles: Comprehensive adherence to clean code and design principles
  • Type Safety: Strict PHP typing with declare(strict_types=1) throughout

  Security Features

  • Token Lifecycle Management: Automatic expiration with database cleanup
  • Replay Attack Prevention: Single-use codes with proper usage tracking
  • Failed Attempt Logging: Comprehensive logging of all authentication events
  • Account Validation: Verifies customer account existence before OTP generation
  • Session Security: Proper session handling and regeneration practices

  Controller Implementation

  • RequestOtp Controller: Handles OTP generation and email sending with validation
  • VerifyOtp Controller: Manages OTP validation and customer authentication
  • Verify Controller: Displays verification page with proper session management
  • AJAX Support: Full AJAX compatibility for enhanced user experience
  • Error Handling: Comprehensive error handling with user-friendly feedback

  Frontend Integration

  • Route System: Custom frontend routes for complete OTP authentication workflow
  • Layout Integration: Seamless integration with Magento customer login layouts
  • Form Validation: Client-side and server-side validation for all user inputs
  • Message System: Integration with Magento's message manager for user feedback
  • CSS Framework: Professional styling with responsive design considerations

  Email Template Features

  • Prominent OTP Display: Large, styled OTP code with monospace font and clear styling
  • Security Information: Clear instructions and warnings about OTP usage and timing
  • Timing Information: Shows expiration time and request timestamp for clarity
  • Mobile Responsive: Optimized email templates for all email clients and devices
  • Brand Integration: Customizable templates with store branding and identity

  Automated Maintenance

  • Cron Job Implementation: Daily cleanup of expired OTP codes and lockout records
  • Performance Optimization: Maintains database performance through automated cleanup
  • Schedule Configuration: Runs daily at 2:00 AM with configurable timing
  • Logging Integration: Comprehensive logging of all cleanup and maintenance operations

  Admin Configuration

  • System Configuration: Complete admin panel configuration interface
  • Security Settings: Configurable attempt limits and lockout duration parameters
  • Email Configuration: Template selection and sender identity configuration
  • Store Scope Support: Full multi-store and multi-website configuration inheritance
  • Default Values: Sensible defaults with enterprise-grade security parameters

  Developer Features

  • Extensible Architecture: Plugin-friendly design for custom extensions and modifications
  • Event Integration: Integration with Magento's event system for customization
  • Logging Framework: Comprehensive logging for debugging and monitoring
  • Documentation: Complete PHPDoc documentation throughout the codebase
  • Testing Support: Architecture designed for comprehensive unit and integration testing

  Integration Points

  • Customer Repository: Native integration with Magento's customer management system
  • Session Management: Full integration with Magento's customer session handling
  • Email System: Complete integration with Magento's email and template systems
  • Configuration System: Native integration with Magento's system configuration
  • Frontend Framework: Seamless integration with Magento's frontend architecture