About this plugin
Login with Frica ID lets visitors sign into your WordPress site through their Frica ID account. A site administrator registers a Frica developer application and configures its OAuth Client ID. No client secret or API key is required.
Learn more at Frica ID.
Features:
- Login button on the standard WordPress sign-in and registration screens.
- [frica_id_login] shortcode for pages, posts and shortcode blocks.
- Explicit connection and disconnection from the user’s own WordPress Profile.
- Optional new Subscriber accounts, only when WordPress registration is also enabled.
- Verified email required; matching email alone never attaches to an existing account.
- PKCE S256, browser-bound single-use state, OIDC nonce, RS256 signature and claim validation.
- HTTPS-only operation, safe local return URLs, and no stored access or refresh tokens.
- Clear errors for unverified email, existing accounts, expired attempts and closed registration.
- Existing WordPress passwords and recovery remain available.
The plugin does not expose Frica’s internal account reference in the user interface. It stores a private one-way hash to recognize the connected account. It does not fetch KYC, wallet, phone, or payment information.
External service
id. id/dashboard/developer.
id/oauth/authorize and Frica’s login/consent screens. id/oauth/userinfo. json and cached for one hour.
id/oauth/revoke for revocation. WordPress HTTP requests naturally send the site’s server IP to Frica; browser sign-in sends the visitor’s IP and browser details to Frica.
Requested scopes: openid profile email. No analytics, tracking pixels, remote fonts or external JavaScript are included. WordPress authentication cookies remain governed by WordPress.
id/legal/privacy
id/legal/terms
A secure browser cookie and server-side login transaction expire after ten minutes. Expired transaction records are removed during scheduled cleanup or the next attempt. A short-lived keyed hash of the requesting IP address rate-limits sign-in starts; no raw IP is stored by the plugin.
WordPress profiles and private connection hashes remain until disconnected, account deletion or plugin uninstall. Uninstall removes plugin settings and connections, not WordPress accounts. Add the supplied suggested text to your site’s privacy policy and configure your web server to omit callback query strings from logs.