=== MeraOTP – OTP Verification for WordPress ===
Contributors: meraotp
Tags: otp, mobile verification, woocommerce, authentication, india
Requires at least: 6.2
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add Indian mobile OTP verification to WordPress and WooCommerce with your MeraOTP account.

== Description ==

MeraOTP connects WordPress to the MeraOTP OTP-only API. It keeps the account API key on your WordPress server and provides:

* A responsive verification form through the `[meraotp_verify]` shortcode.
* Optional verification of the billing phone on WooCommerce classic checkout.
* A connection test that shows the hosting server's public outbound IP.
* A real test-OTP tool.
* PHP functions for sending, verifying, and checking an OTP.
* A server-side action after successful verification.
* A signed, short-lived verification proof for custom form integrations.

The plugin does not send promotional or general SMS messages.

== External service ==

This plugin connects to MeraOTP at https://new.meraotp.in to send and verify OTPs. It sends the configured MeraOTP API key, the recipient's Indian mobile number, OTP purpose, an optional internal reference, request idempotency value, and normal HTTP connection metadata such as the hosting server IP. When verifying, it sends the MeraOTP message ID and the OTP entered by the visitor.

Data is sent only when an administrator runs a connection/test action, when a visitor requests or verifies an OTP through a MeraOTP form, when WooCommerce checkout verification is used, or when site code calls a MeraOTP PHP function.

Service terms: https://new.meraotp.in/terms-and-conditions
Privacy policy: https://new.meraotp.in/privacy-policy
Acceptable use: https://new.meraotp.in/acceptable-use
DLT guidance: https://new.meraotp.in/dlt-compliance

== Installation ==

1. Upload `meraotp-wordpress.zip` through Plugins → Add New Plugin → Upload Plugin.
2. Activate MeraOTP.
3. Open Settings → MeraOTP.
4. Paste the single API key shown in your MeraOTP account and save.
5. Choose Test connection. Add the reported server IP to the MeraOTP IP whitelist if needed.
6. Add `[meraotp_verify]` to a page or enable WooCommerce classic checkout verification.

Complete guide: https://new.meraotp.in/wordpress-plugin

== Shortcode ==

Basic:

`[meraotp_verify]`

Customized:

`[meraotp_verify purpose="signup" title="Verify your phone" button_text="Send my code"]`

Supported purposes: `login`, `signup`, `password_reset`, `transaction`, `verification`, and `other`.

== PHP API ==

Send:

`$result = meraotp_send_otp('9876543210', 'signup', 'user_42');`

Verify:

`$result = meraotp_verify_otp($message_id, $otp_entered_by_user);`

Status:

`$result = meraotp_otp_status($message_id);`

All functions return a decoded MeraOTP response array on success or `WP_Error` on failure.

Successful shortcode verification fires:

`do_action('meraotp_phone_verified', $mobile, $purpose, $message_id);`

Validate a proof posted from a custom form:

`$payload = meraotp_validate_proof($_POST['meraotp_proof']);`

== Frequently Asked Questions ==

= Does the plugin expose my API key? =

No. API calls are made by WordPress on the server. The key is not localized into frontend JavaScript or added to HTML.

= Does it require an OTP subscription? =

No. OTP uses your prepaid MeraOTP wallet and the current rate shown in your account.

= Why must I whitelist an IP? =

MeraOTP accepts production API calls from localhost or server IPs added to the account. The connection test shows the exact outbound IP received by MeraOTP.

= Does it support WooCommerce Checkout Blocks? =

Version 1.0 protects the classic WooCommerce checkout. It does not modify Checkout Blocks.

= Can I put my API key in JavaScript? =

No. Keep it in WordPress settings or server-side configuration only.

== Changelog ==

= 1.0.0 =

* Initial OTP-only WordPress release.
* Verification shortcode.
* WooCommerce classic checkout verification.
* Connection, outbound-IP, and real-OTP test tools.
* PHP helper functions, action hook, and signed verification proofs.
