Fastkit OTP Authentication & Notifications for WooCommerce

Press Connect to Wakit and a window opens on Wakit. Put in your mobile
number, confirm the code that arrives on WhatsApp — an account is created there
and then if you do not have one — and choose which workspace pays for messages
and which approved template this site may send on. Approve, and the window
closes on your WordPress screen with the workspace, the balance and the template
already filled in.

Then:

• Templates. See every template you can send on, write a new one, and watch
  it move from review to approved without leaving WordPress.
• Order notifications. When an order moves to Processing, Completed or any
  other status, the customer gets a WhatsApp message. Each status picks its own
  template and its own variables, built from merge tags like {full_name} and
  {order_number}.
• Sign in with WhatsApp. A [wakit_otp_login] form takes a mobile number,
  sends a code, and signs the matching account in. It also appears under the
  usual login box on wp-login.php.
• Sign in to wp-admin with a mobile number. Switch on wp-admin sign-in and
  administrators and shop managers can use the same form: number, code from
  WhatsApp, straight to the screen they were asking for. Each of those accounts
  puts its number on its own profile, under Sign in with WhatsApp.
• Your WhatsApp numbers. The dashboard shows the Cloud API numbers on your
  Wakit workspace, which one your customers see the message arrive from, and
  whether it can send today. Connect a new one on Wakit — the button gets you
  there already signed in — and it appears here on the next look.
• Send log. Every attempt, successful or not, with what Meta said about
  the failures.

Two kinds of account, and why the screens differ

You have your own WhatsApp Business number. You own that account, so every
template on it is yours, and a new one goes straight to WhatsApp for approval.

You are on Wakit’s shared number. You send from a number other businesses
also send from, so you use the templates Wakit has assigned to you — never
anybody else’s, and nobody else ever sees yours. A template you write is read by
Wakit before WhatsApp is shown it: on a shared number, WhatsApp holds everyone
to what any one of them sends.

What the site can and cannot do

This site can only send templates the workspace already has. Naming anything
else is refused by Wakit, not by the plugin — so a compromised WordPress install
cannot invent a message to send, and a plugin added here never widens what may
go out from a workspace.

The API key is swapped for on the server, never travels through a browser, and
is stored encrypted with a key that lives in wp-config.php. A database dump on
its own is not a working credential.

External services

This plugin connects your site to Wakit (https://wakit.in), which is the service
that actually delivers the WhatsApp messages. Without a Wakit account the plugin
cannot send anything, so using this plugin means using that service.

Everything below is sent from your server to https://wakit.in/api/v1 over
HTTPS, signed with the API key this site was given when you connected it.

• Connecting the site. Pressing “Connect to Wakit” opens
  https://wakit.in/connect/authorize in a window and gives it this site’s
  wp-admin address to come back to. When you approve there, the one-time code
  that comes back is exchanged at /connect/exchange for an API key. Nothing
  about your WordPress users is part of this step.
• Sending a WhatsApp message. When an order reaches a status you have
  switched on, the plugin posts to /messages/template: the customer’s mobile
  number in international format, the name of the approved template to send, and
  the values you mapped into that template’s variables — usually the customer’s
  name and the order’s number, total and status. A test send does the same with
  the number you type in.
• Signing in with a code. The sign-in form posts the mobile number typed
  into it to /otp/send, then that send’s id together with the code the visitor
  typed to /otp/verify.
• Reading your account. The admin screens fetch /account, /connect/me,
  /numbers and /templates for your wallet balance, the WhatsApp numbers on
  your workspace and the templates you may send on. Writing a template posts its
  name, language, category and text to /templates. Opening Wakit from a button
  in wp-admin asks /connect/sso for a one-time signed-in link.

Nothing is sent anywhere until you connect the site, and no customer data is
sent until you switch on a feature that needs it.

Wakit’s terms of service: https://wakit.in/terms
Wakit’s privacy policy: https://wakit.in/privacy