HelpWP clients never set or reset a password. Instead, they enter their email address, receive a one-time code, and get signed in for the session.
The visitor flow
- The client visits the Submit a ticket or My Tickets page.
- If they are not logged in, the page shows a small form: Enter your email.
- They type their email and click Send code.
- HelpWP emails them a 6-digit verification code.
- They paste the code into the form and click Verify.
- They land on the original page, signed in.
Behind the scenes
- A short-lived transient is stored under
helpwplogin_<key>for 5 minutes. After 5 minutes the link expires and the client has to request a new one. - The link / code resolves to a user ID and a redirect URL. HelpWP signs the matching user in and sends them to the redirect URL.
- If the email does not match an existing WordPress user, a new user is created with the HelpWP User role and the email is set as both the username and the email address. The display name is taken from the name field on the new-ticket form when present.
Login links inside emails
Every notification email that links a client back to their ticket uses an “helpwplogin link”: a URL with a ?helpwplogin={key} query parameter. Clicking the link signs the client in and redirects them to the ticket – no code entry required. These links are also single-use and expire after 5 minutes.
Customizing the verification email
The body, subject, and header of the Login verification code email are editable under HelpWP -> Settings -> Emails -> Login verification code. The placeholder ##code## is replaced with the 6-digit code at send time.
Why no passwords
Most support tickets that include “I forgot my password” are not real support requests. Passwordless login eliminates the entire category. Clients always have access via their email; agents never have to handle credential resets.
Was this doc helpful?