Login with Frica ID

Login with Frica ID lets visitors sign into your WordPress site through their Frica ID account. A site administrator registers a Frica developer application and configures its OAuth Client ID. No client secret or API key is required.

Learn more at Frica ID.

Features:

• Login button on the standard WordPress sign-in and registration screens.
• [frica_id_login] shortcode for pages, posts and shortcode blocks.
• Explicit connection and disconnection from the user’s own WordPress Profile.
• Optional new Subscriber accounts, only when WordPress registration is also enabled.
• Verified email required; matching email alone never attaches to an existing account.
• PKCE S256, browser-bound single-use state, OIDC nonce, RS256 signature and claim validation.
• HTTPS-only operation, safe local return URLs, and no stored access or refresh tokens.
• Clear errors for unverified email, existing accounts, expired attempts and closed registration.
• Existing WordPress passwords and recovery remain available.

The plugin does not expose Frica’s internal account reference in the user interface. It stores a private one-way hash to recognize the connected account. It does not fetch KYC, wallet, phone, or payment information.

External service

This plugin connects to Frica ID, an external authentication service operated at https://frica.id. An administrator must register a developer application at https://frica.id/dashboard/developer.

Only when a visitor starts sign-in or connects their account, their browser is redirected to https://api.frica.id/oauth/authorize and Frica’s login/consent screens. The site exchanges the returned authorization code at https://api.frica.id/oauth/token and requests the user’s name, Public Frica ID and verified email at https://api.frica.id/oauth/userinfo. Public signing keys are retrieved from https://api.frica.id/.well-known/jwks.json and cached for one hour. Unneeded refresh tokens are sent to https://api.frica.id/oauth/revoke for revocation. WordPress HTTP requests naturally send the site’s server IP to Frica; browser sign-in sends the visitor’s IP and browser details to Frica.

Requested scopes: openid profile email. No analytics, tracking pixels, remote fonts or external JavaScript are included. WordPress authentication cookies remain governed by WordPress.

Frica privacy policy: https://frica.id/legal/privacy
Frica terms: https://frica.id/legal/terms

A secure browser cookie and server-side login transaction expire after ten minutes. Expired transaction records are removed during scheduled cleanup or the next attempt. A short-lived keyed hash of the requesting IP address rate-limits sign-in starts; no raw IP is stored by the plugin. WordPress profiles and private connection hashes remain until disconnected, account deletion or plugin uninstall. Uninstall removes plugin settings and connections, not WordPress accounts. Add the supplied suggested text to your site’s privacy policy and configure your web server to omit callback query strings from logs.