New: developer API — other plugins on the same site can use OneCode Login as a generic email one-time-code (OTP) service. They request a code for any email address, then verify the code together with a server-side secret. Identity assertion only: OneCode confirms the code is valid for the email but never logs anyone in, so the integrating plugin keeps full control of its own session. See the “Developer information” section for the code-level integration.
New: api_enabled setting (Advanced tab) to turn the developer API on or off.
Security: verification codes and magic-link tokens are now stored HMAC-hashed instead of in plain text.
Security: client IP detection no longer trusts spoofable proxy headers by default (opt in via the onecode_login_trust_proxy_headers filter when behind a trusted proxy).
Security: magic-link verification is now rate-limited per IP as well as per email.
Privacy: debug logging no longer records verification codes or full email addresses (emails are masked).
Privacy: added WordPress personal-data exporter and eraser, plus a suggested Privacy Policy snippet.
Internal: codes are scoped per channel so the developer API and the built-in login never interfere with each other; verification uses an atomic single-use claim.
Note: upgrading from 1.0.2 or earlier clears any pending codes/tokens once (storage-format change); users simply request a new code.
1.0.2
Fix: assets are now loaded reliably when the shortcode/block is present on the page (prevents first-submit failure under aggressive page caching or JS optimization).
Fix: clear leftover code/rate-limit rows from earlier versions whose timestamps were stored in the local PHP timezone instead of UTC.
1.0.1
Small bug fixes
1.0.0
Initial release
Passwordless login with 6-digit verification codes
