Mobile OTP verification for WordPress—without building it yourself.

Step 1

Install the plugin

1. Download meraotp-wordpress.zip using the button above.
2. In WordPress open Plugins → Add New Plugin → Upload Plugin.
3. Select the ZIP, choose Install Now, and then Activate.
4. Open Settings → MeraOTP.

Step 2

Connect your MeraOTP account

1. Create a MeraOTP account, verify it, and add OTP credit.
2. Open API key in the MeraOTP dashboard and copy your single account key.
3. Paste it under Settings → MeraOTP and save.
4. Select Test connection. The check shows the public outbound IP received from your WordPress server.
5. Add that IP to the MeraOTP whitelist. No admin approval is required.
6. Run the connection check again, then send a real test OTP.

Step 3

Add verification to a page

Add a Shortcode block in Gutenberg or paste this shortcode into the classic editor:

[meraotp_verify]

Choose the purpose and change the visible heading when needed:

[meraotp_verify purpose="signup" title="Verify your phone" button_text="Send my code"]

Supported purposes are login, signup, password_reset, transaction, verification, and other.

Optional

Protect WooCommerce checkout

Open Settings → MeraOTP, enable Require phone OTP verification, and save. The customer must verify the billing phone before placing an order.

Custom WordPress/PHP

Use the plugin from PHP

The plugin exposes small functions for a custom theme or plugin. Always send from backend PHP, never from browser JavaScript.

<?php
$sent = meraotp_send_otp(
    '9876543210',       // Indian mobile number
    'signup',          // Why the OTP is being sent
    'wordpress_user_42' // Your optional reference
);

if (is_wp_error($sent)) {
    error_log($sent->get_error_message());
    return;
}

$message_id = $sent['data']['message_id'];

// Later, verify the six-digit code entered by the user.
$checked = meraotp_verify_otp($message_id, '123456');
$verified = !is_wp_error($checked)
    && !empty($checked['data']['verified']);

React after the shortcode verifies a number

add_action('meraotp_phone_verified', function ($mobile, $purpose, $message_id) {
    // Run your server-side action here.
}, 10, 3);

If another form submits the shortcode's meraotp_proof field, validate it on the server with meraotp_validate_proof($proof) before trusting it.

Standalone PHP application

Outside WordPress, call the same API from backend PHP with cURL:

<?php
$payload = json_encode([
    'mobile' => '9876543210',
    'purpose' => 'signup',
    'reference' => 'student_1001',
]);

$ch = curl_init('https://new.meraotp.in/api/v1/otp/send');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $payload,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('MERAOTP_API_KEY'),
        'Content-Type: application/json',
        'Idempotency-Key: signup_' . bin2hex(random_bytes(12)),
    ],
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($body === false) {
    throw new RuntimeException(curl_error($ch));
}
curl_close($ch);

$result = json_decode($body, true, 512, JSON_THROW_ON_ERROR);
if ($status < 200 || $status >= 300 || empty($result['success'])) {
    throw new RuntimeException($result['message'] ?? 'OTP could not be sent');
}
$messageId = $result['data']['message_id'];

When the user enters the code, post the returned message_id and OTP to the verify endpoint:

<?php
$ch = curl_init('https://new.meraotp.in/api/v1/otp/verify');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode([
        'message_id' => $messageId,
        'otp' => $userEnteredOtp,
    ]),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('MERAOTP_API_KEY'),
        'Content-Type: application/json',
    ],
]);
$result = json_decode(curl_exec($ch), true, 512, JSON_THROW_ON_ERROR);
curl_close($ch);
$verified = !empty($result['success']) && !empty($result['data']['verified']);

Direct API · Node.js

Use MeraOTP without WordPress

Node.js does not run the WordPress plugin. Use the same OTP API directly from your Node backend and keep the key in an environment variable.

// Node.js 18+
const response = await fetch('https://new.meraotp.in/api/v1/otp/send', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.MERAOTP_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': `signup_${crypto.randomUUID()}`
  },
  body: JSON.stringify({
    mobile: '9876543210',
    purpose: 'signup',
    reference: 'student_1001'
  })
});

const result = await response.json();
if (!response.ok || !result.success) {
  throw new Error(result.message || 'OTP could not be sent');
}
const messageId = result.data.message_id;

Verify the code

const response = await fetch('https://new.meraotp.in/api/v1/otp/verify', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.MERAOTP_API_KEY}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ message_id: messageId, otp: userEnteredOtp })
});
const result = await response.json();
const verified = response.ok && result.success && result.data.verified;

Quick fixes

Common setup problems