composer require aheadworks/module-passwordless-login<version>

Introducing to Magento 2 Passwordless Login

Extension Overview

The Passwordless Login for Magento 2 extension streamlines store authentication by replacing traditional passwords with quick one-time passcodes (OTP) and direct email Magic Links. Operating seamlessly across login and checkout pages, it eliminates forgotten password friction and cuts cart abandonment.

The module supports hybrid login—giving shoppers a choice between passwordless entry and standard passwords—while protecting your store with brute-force lockouts, request throttling, cart merging, and GDPR-compliant registration.

Key Features

• Log in instantly using 6-digit email OTP codes or one-click Magic Links.

• Offer flexible sign-in with both passwordless options and traditional password login.

• Keep users on the checkout page post-login while merging guest items into their cart.

• Authorize desktop waiting sessions automatically when clicking a Magic Link on a phone.

• Support seamless auto-registration or account confirmation prompts for GDPR compliance.

• Protect your mail server with attempt limits, resend cooldown timers, and daily code caps.

Using Magento 2 Passwordless Login

Extension Configuration

To configure the module settings, navigate to Stores → Configuration → Customers → Passwordless Authentication.

By default, all settings inherit standard system values and the extension is ready to work out of the box. To customize any option for a specific scope, uncheck the Use system value box next to the corresponding field.

The settings interface is divided into logical sections. Click any section header to expand or collapse its options.

General Settings

• Enable Extension — Acts as the global on/off switch for the extension. Set to Yes to enable Passwordless Authentication.

• Enable Standard Password Login — Allows customers to use a traditional password alongside the OTP/Magic Link flow.

• Authentication Mode — Determines which passwordless methods are available on the storefront:

• OTP Code Only — Customers log in using a one-time numeric verification code sent to their email.

• Magic Link Only — Customers log in by clicking a direct authorization link sent to their email.

• Hybrid (User chooses) — Customers can choose their preferred passwordless method directly on the storefront.

• Unknown Email Behavior — Dictates how the system responds when an entered email address does not exist in the database:

• Auto-Register (Frictionless) — Silently sends a verification code and creates an account upon success.

• Prompt to Register — Shows an "Account not found" message and displays a button to create a new account.

Passwordless Settings

• OTP Code Length — Defines the required number of digits for the generated OTP. Allowed values: 4 to 8. 

• OTP Token Expiry (Minutes) — The maximum time (in minutes) the code remains valid in the database. Protects against email delivery delays. 

• Magic Link Expiry (Minutes) — Dictates how long a magic link remains valid and clickable. It is recommended to be longer than the OTP expiry. 

Magic Link Config

• Enable Cross Device Login — Allows a waiting browser session to be signed in automatically after the magic link is opened in another browser or device.

• Post-Login Redirect — Defines the destination URL after clicking a magic link. If a customer is on checkout, they always stay on checkout, disregarding this setting:

• Customer Dashboard — Redirects the customer to their account dashboard upon successful login.

• Homepage — Redirects the customer to the store's homepage upon successful login.

• Stay on Current Page — Keeps the customer on the page where they requested the magic link.

Security & Throttling

• Max Failed Attempts — Sets the exact lockout threshold for incorrect code entries to protect against brute-force exhaustion.

• Resend Button Cooldown (Seconds) — The time (in seconds) the user must wait before the 'Resend' button becomes active on the storefront. Prevents inbox spamming.

• Max Codes Per Day — The maximum number of OTP/Magic Link requests allowed per email address within a 24-hour period. Prevents email bombing and protects mail server reputation.

Email Templates

• Configuration Scope — Email templates are configured per store view. Switch the scope to a specific store view to edit them.

• Login OTP Template — Transactional email template used when sending codes to existing users.

• Registration OTP Template — Transactional email template used for welcoming new users via frictionless registration.

• Magic Link Template — Transactional email template used for sending the clickable magic link.

Customizing Email Templates

To customize the transactional email templates used by Passwordless Login:

1. Navigate to Marketing → Communications → Email Templates.

2. Click Add New Template.

3. In the Load Default Template section, select one of the module's templates from the Template dropdown:

•    Passwordless Login OTP (Default)

•    Passwordless Registration OTP (Default)

•    Passwordless Magic Link (Default)

4. Click Load Template.

5. Customize the template content, subject line, and styles as needed. Ensure required variables (such as {{var code}} or {{var magic_link_url}}) remain intact.

6. Save the template under a distinct name.

7. Return to Stores → Configuration → Customers → Passwordless Authentication → Email Templates and assign your custom template to the corresponding field for your target Store View.