This add-on verifies that a customer really owns the phone number or email they provide, using a one-time password (OTP) sent by SMS or email. You can require verification at checkout, login, or registration, and let customers sign in by phone.
Plan: Pro (Beta) Add-on: Verification Where: StoreEngine → Settings → Verification
What You Can Do
- Send a verification code by SMS (Twilio, Vonage, or generic) or by email.
- Require customers to verify before checkout, login, or registration.
- Let customers use their phone number as their login identity.
- Optionally make OTP the only way to sign in (no passwords for customers).
- Reduce fake orders by requiring verified contact at checkout.
Turn On Verification
- Go to StoreEngine → Add-ons.
- Toggle on Verification.
- Configure at StoreEngine → Settings → Verification.

| Note: Email OTP works out of the box. Phone (SMS) OTP needs an SMS gateway configured first. |
Configure Verification

Identifier Mode
Choose how customers identify themselves:
- Email only — customers are identified and verified by email address.
- Phone only — customers are identified and verified by phone number. This option requires an SMS gateway.
- Phone or email — customers can use either a phone number or an email address.
Default dialing code — the country dialing code applied to phone numbers, entered as digits only (for example, 880).
Verification (Anti-Fake Order)
- Require OTP verification of the customer contact at checkout — customers must verify their phone or email with a code before they can place an order.
- Force OTP for every login & registration — customers sign in only with a code; this disables password sign-in for customers. Staff with admin or manager roles can still use passwords.
OTP Behaviour
|
Setting |
Default |
What It Does |
|
Verified window (seconds) |
900 |
How long a code remains usable before it expires (300 seconds = 5 minutes). |
|
Code length |
6 |
Number of digits in the verification code. |
|
Code expiry (seconds) |
300 |
How long a code remains usable before it expires (300 seconds = 5 minutes). |
|
Resend cooldown (seconds) |
60 |
Minimum wait before a customer can request a new code. |
|
Max verify attempts |
5 |
Wrong tries allowed before the code is locked. |
|
Max codes per hour |
5 |
Codes a single contact can request per hour. |
SMS Channel
Pick the Active SMS gateway and enter its details. The Generic HTTP gateway lets you connect any SMS provider that accepts an HTTP request.
- Endpoint URL — the provider’s send URL (for example, https://api.example.com/send).
- HTTP Method — the request method, typically POST.
- Body Content-Type — the request body format, such as form.
- Authorization Header (optional) — an auth token if your provider requires one (for example, Bearer xxxx).
- Body Template — the request payload, for example
{"to":"{to}","message":"{message}"}. - SMS message template — the text customers receive, for example Your
{store_name}verification code is{code}.
Tokens: {code}, {store_name}.
Email Channel
Email OTP requires no extra setup. Customise the message sent to customers:
- Email subject — the subject line, for example Your
{store_name}verification code. - Email body (HTML) — the HTML content of the verification email. Insert the code with the {code} token.
Tokens: {code}, {store_name}.
Save Your Changes
Click Save Settings at the top right of the page to apply your configuration.
Troubleshooting
|
Problem |
What to Check |
|
Verification is not required at checkout |
In Phone only mode with no SMS gateway, enforcement is disabled. Configure a gateway. |
|
Customer did not get the SMS |
Check SMS gateway credentials and balance. |
|
Please wait when requesting a code |
Customer is within the resend cooldown — wait the configured seconds. |
|
Code says it is expired |
Codes expire after the code expiry time. Request a new one. |
|
Staff are blocked by Force OTP |
Staff with admin/manager roles are exempt and can still use passwords. |








