- Docs
- Checkout
- SMS login (OTP)
SMS login (OTP)
How to enable login with a one-time SMS code in the Trust template for OpenCart 3: code length and expiry, brute-force protection, attempt logs.
Customers log in with their phone number: they enter the number, get an SMS with a one-time code (OTP) and enter it — no password needed.
Requires the SMS Notify module. Codes are sent by your SMS provider connected in the SMS Notify module. Its “SMS Authorization” template must be active — otherwise a warning appears in the OTP settings.
Settings
Open Octemplates → Modules → Authorization by SMS (OTP).
| Setting | What it does | Recommended |
|---|---|---|
| Status | Enables login by code. | |
| OTP Length | Number of digits in the code, from 4 to 10. | 6 |
| OTP Expiry | How many minutes the code is valid. | 5 |
| Max Attempts | How many wrong numbers or codes are allowed before lockout. | 5 |
| Lockout Time | For how many minutes login is blocked after too many attempts. | 15 |
| Throttle Time | Minimum seconds between code requests — protection against spam and unnecessary SMS costs. | 60 |
| Send OTP on Email Authorization | If the customer logs in by email, the code is sent by email. | |
| Enable Logging | Records login attempts on the “OTP Logs” tab. |
Tip. Don’t set “Throttle Time” below 30 seconds: every SMS costs money, and bots can request codes in bulk.
Logs
- OTP Logs — all code entry attempts: contact, customer, status and date. Helps when a customer says the code didn’t arrive.
- IP Logs — IP addresses that entered a wrong number or code, the number of attempts and the time of the last one. This reveals guessing attempts.
The “Delete Logs” button clears the list.