finderpress.
Finding your next read
Practical craft for people building for the web.
Explore DevelopmentFinding your next read
THE FINDERPRESS TOOL DIRECTORY
Explore this tool and check the official listing for its latest features and requirements.
01 / SOURCE DETAILS
Press Connect to Wakit and a window opens on Wakit. Put in your mobile number, confirm the code that arrives on WhatsApp — an account is created there and then if you do not have one — and choose which workspace pays for messages and which approved template this site may send on. Approve, and the window closes on your WordPress screen with the workspace, the balance and the template already filled in. Then: Templates. See every template you can send on, write a new one, and watch it move from review to approved without leaving WordPress. Order notifications. When an order moves to Processing, Completed or any other status, the customer gets a WhatsApp message. Each status picks its own template and its own variables, built from merge tags like {full_name} and {order_number}. Sign in with WhatsApp. A [wakit_otp_login] form takes a mobile number, sends a code, and signs the matching account in. It also appears under the usual login box on wp-login.php when wp-admin sign-in is switched on. Sign in to wp-admin with a mobile number. Switch on wp-admin sign-in and administrators and shop managers can use the same form: number, code from WhatsApp, straight to the screen they were asking for. Each of those accounts puts its number on its own profile, under Sign in with WhatsApp . Your WhatsApp numbers. The dashboard shows the Cloud API numbers on your Wakit workspace, which one your customers see the message arrive from, and whether it can send today. Connect a new one on Wakit — the button gets you there already signed in — and it appears here on the next look. Send log. Every attempt, successful or not, with what Meta said about the failures. Two kinds of account, and why the screens differ You have your own WhatsApp Business number. You own that account, so every template on it is yours, and a new one goes straight to WhatsApp for approval. You are on Wakit’s shared number. You send from a number other businesses also send from, so you use the templates Wakit has assigned to you — never anybody else’s, and nobody else ever sees yours. A template you write is read by Wakit before WhatsApp is shown it: on a shared number, WhatsApp holds everyone to what any one of them sends. What the site can and cannot do This site can only send templates the workspace already has. Naming anything else is refused by Wakit, not by the plugin — so a compromised WordPress install cannot invent a message to send, and a plugin added here never widens what may go out from a workspace. The API key is swapped for on the server, never travels through a browser, and is stored encrypted with a key that lives in wp-config.php . A database dump on its own is not a working credential. External services This plugin connects your site to Wakit (https://wakit.in), which is the service that actually delivers the WhatsApp messages. Without a Wakit account the plugin cannot send anything, so using this plugin means using that service. Everything below is sent from your server to https://wakit.in/api/v1 over HTTPS, signed with the API key this site was given when you connected it. Connecting the site. Pressing “Connect to Wakit” opens https://wakit.in/connect/authorize in a window and gives it this site’s wp-admin address to come back to. When you approve there, the one-time code that comes back is exchanged at /connect/exchange for an API key. Nothing about your WordPress users is part of this step. Sending a WhatsApp message. When an order reaches a status you have switched on, the plugin posts to /messages/template : the customer’s mobile number in international format, the name of the approved template to send, and the values you mapped into that template’s variables — usually the customer’s name and the order’s number, total and status. A test send does the same with the number you type in. Signing in with a code. The sign-in form posts the mobile number typed into it to /otp/send , then that send’s id together with the code the visitor typed to /otp/verify . Reading your account. The admin screens fetch /account , /connect/me , /numbers and /templates for your wallet balance, the WhatsApp numbers on your workspace and the templates you may send on. Writing a template posts its name, language, category and text to /templates . Opening Wakit from a button in wp-admin asks /connect/sso for a one-time signed-in link. Nothing is sent anywhere until you connect the site, and no customer data is sent until you switch on a feature that needs it. Wakit’s terms of service: https://wakit.in/terms Wakit’s privacy policy: https://wakit.in/privacy
02 / SOURCE DETAILS
Upload the gowakit-otp-authentication-notifications-for-woocommerce folder to /wp-content/plugins/, or install the zip from Plugins → Add New → Upload . Activate it. Go to Wakit and press Connect to Wakit . Your site must be on HTTPS. Wakit refuses to send the connect code back over plain http, where it would travel in clear text — the one exception is a site running on localhost for development. To point at a self-hosted Wakit, define this in wp-config.php before the plugin loads: define( 'WAKIT_BASE_URL', 'https://wakit.example.com' );
03 / SOURCE DETAILS
Nothing arrives, but the log says “Sent”. “Sent” means Meta accepted the message. Delivery after that depends on the number having WhatsApp and not having blocked the sender. Open the Wakit dashboard to follow a specific message. A send fails with “template name does not exist”. The template was approved on a different WhatsApp number than the one the workspace now sends from. Reconnect from the Wakit screen and pick it again. Sends fail after I changed the number of variables. Meta counts the variables and rejects a mismatch. The template decides how many there are — fill in exactly that many rows and leave the rest blank. Can an administrator sign in to wp-admin with a code? Yes, but two things have to be true, and neither happens on its own. Tick wp-admin sign-in under Wakit → OTP sign-in , and put the mobile number on the account itself — Users → Profile → Sign in with WhatsApp . An administrator usually has no billing address, so without that field there is no number to match and the form will say no account uses it. It is off by default for a reason. A phone number that reaches an account which can edit the whole site is a much bigger thing to hand over than one that reaches a customer account: whoever holds that SIM, or can have it reissued, holds the site. I signed in with a code and landed on the shop’s account page, not wp-admin. Fixed in 1.1.0. The form now carries the page you were sent to the login screen from, and anyone who can edit posts or orders is taken to wp-admin by default. The destination is checked on the server, so a link cannot use the login form to bounce you off to another site. Two accounts have the same mobile number. Only one can keep it. The profile field refuses a number that already signs in another account, and names the account holding it — the sign-in form has to be able to say which account a code belongs to. A customer’s number keeps changing back after checkout. A number typed on the profile screen is fixed to the account and a later checkout no longer moves it. A number that was only ever copied from the billing address still follows the billing address; the profile screen says which of the two you are looking at. Clear the field to go back to following billing. Someone could spam the sign-in form and spend my balance. An unknown number is turned away before anything is sent, and each number and each address is capped per hour. Switching on “create an account for a number that does not have one” removes the first of those protections, which is why it is off by default. I deleted the plugin. Is the key gone? The copy stored here is deleted on uninstall. The key itself stays live on Wakit until you revoke it there, under API keys. Where did my template go? Check Templates . “Waiting for Wakit” means it is in their review queue; “With WhatsApp” means it has been passed on and they are reading it. A refusal from either shows the reason on the row. I wrote “order_update” but the list shows something longer. On Wakit’s shared number a name is claimed once for everyone, so your account name goes in front of yours. Nobody else can then take it, and you can tell your templates apart from the rest at a glance.
KEEP EXPLORING