=== Tuurio ID – Passkey Login, SSO & 2FA ===
Contributors: tuurio
Tags: passkeys, passwordless, sso, two-factor-authentication, webauthn
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.99.3
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Passkey login and single sign-on for WordPress and WooCommerce with Tuurio ID, an EU-hosted identity service. A guided setup connects your site.

== Description ==

Let people sign in to your website with a passkey instead of a password, and use one sign-in across all your sites.

This plugin connects WordPress to [Tuurio ID](https://id.tuurio.com), an EU-hosted identity service. People sign in at Tuurio ID with a passkey, a password or a second factor, and come back signed in to your site. Your site never sees their password.

= What you get =

* **"Continue with Tuurio ID"** on the WordPress login page, in WooCommerce "My account" and checkout, and as a block or shortcode anywhere.
* **Guided setup.** The assistant creates the connection at Tuurio ID and registers your site's addresses for you. Entering the details by hand works too.
* **Tuurio ID only, if you want.** Turn off the WordPress password sign-in for the whole site, or only for the shop's forms. An emergency switch in wp-config.php always gets you back in.
* **Your rules for new people.** Admit new users right away, or let them wait for your approval. Plugins can have their own rule: shop customers can buy at once while a members area waits for approval.
* **Existing accounts.** Connect them automatically when Tuurio ID has confirmed the same email address, or assign them yourself.
* **Roles.** Map Tuurio ID roles to WordPress roles. The last administrator is never demoted.
* **Sign-out in both directions.** Signing out here can end the Tuurio ID session, and signing out at Tuurio ID ends the sessions on your site.
* **Diagnostics.** A self-test, an event log and a warning when another plugin signs people in around the rule you set.

= Works with =

WooCommerce (including the block checkout and HPOS), BuddyPress, Tutor LMS, Ultimate Member, Paid Member Subscriptions, Dokan, SupportCandy and GiveWP. Each integration loads only when its plugin is active.

= For developers =

Authorization Code flow with PKCE (S256), full ID token validation against the signing keys (rejects `alg=none`), back-channel logout, the client secret encrypted at rest (AES-256-GCM), and a documented set of filters and actions.

Translated into German, French, Spanish, Italian and Dutch.

== External service ==

This plugin connects your website to **Tuurio ID**, an identity service operated by Tuurio GmbH and hosted in the EU. Without it the plugin has no function: the sign-in happens at Tuurio ID, not on your site. You need a Tuurio ID account; the setup assistant lets you create one.

**When your site contacts Tuurio ID, and what it sends:**

* **During setup with the assistant:** the addresses of this website (site, callback and post-logout address), the site title as a project name, and a random one-time identifier. You sign in or create your account in a Tuurio ID window, so your name, email address and password never pass through WordPress. Entering the details by hand sends none of this.
* **On every sign-in:** the visitor's browser goes to your Tuurio ID sign-in page with the client ID, the requested scopes (`openid profile email`), the return address and one-time security values. Your server then exchanges a one-time code (with the client secret) for tokens and reads the profile the visitor agreed to share (name, email address), plus the public signing keys.
* **On sign-out:** the Tuurio ID sign-out endpoint, to end the session there as well.
* **Once a day, automatically:** the same connection check the setup assistant ran - discovery document, signing keys, and (with a secret configured) that the stored credentials are still accepted - so a problem is caught before someone is locked out.
* **With member features enabled:** your organisation's user and role names are read.
* **When you open the "Organisation & documents" screen:** the public list of legal documents. No personal data is sent.

WordPress passwords and site content are never sent. There is no telemetry and no analytics. The plugin's "Data & privacy" screen says the same inside your admin area.

* Service: [id.tuurio.com](https://id.tuurio.com)
* Terms of service: [id.tuurio.com/public/legal/terms](https://id.tuurio.com/public/legal/terms)
* Privacy policy: [id.tuurio.com/public/legal/privacy](https://id.tuurio.com/public/legal/privacy)
* Data processing agreement: [id.tuurio.com/public/legal/avv](https://id.tuurio.com/public/legal/avv)
* Sub-processors: [id.tuurio.com/public/legal/sub-processors](https://id.tuurio.com/public/legal/sub-processors)

== Installation ==

1. In WordPress, go to Plugins > Add New, upload the plugin and activate it.
2. The setup assistant opens. Choose "Connect with Tuurio ID".
3. Sign in to Tuurio ID in the window that opens, or create an account there, and confirm the connection.
4. Back in WordPress, connect your administrator account and try the sign-in.
5. Under Tuurio ID > Sign-in, decide whether the WordPress password sign-in stays on.

Already have a client at Tuurio ID? Choose "Enter access data by hand" in step 2 instead.

Recommended: define `TUURIO_ID_SECRET_KEY` in wp-config.php. The client secret is then encrypted with your own key instead of WordPress' secret keys.

== Frequently Asked Questions ==

= Do I need a Tuurio ID account? =

Yes. The sign-in happens at Tuurio ID. You can create an account during setup; see [id.tuurio.com/public/pricing](https://id.tuurio.com/public/pricing) for the plans.

= What happens to my existing users? =

Nothing, until they sign in with Tuurio ID. They can connect their account in their profile, you can assign accounts in advance, or you can let accounts connect automatically when Tuurio ID has confirmed the same email address. Accounts that can manage the site are never connected automatically.

= I switched off the password sign-in and cannot get in. What now? =

Add `define( 'TUURIO_ID_ALLOW_LOCAL_LOGIN', true );` to wp-config.php. The normal login form works again until you remove that line.

= Does it work with WooCommerce? =

Yes, including the block checkout and High-Performance Order Storage. New shop customers can get their account right away while the rest of the site waits for approval.

= Does it work on a multisite network? =

Activated per site - network activation is refused with an explanation, and each site gets its own Tuurio ID client. One current limitation: a WordPress account that connects a Tuurio identity on more than one site of the network currently shares that connection across those sites rather than keeping a separate one per site, so a different identity connected on a second site replaces the first. Keep a Tuurio-connected account to a single site of the network until this is separated per site; the settings screen shows a notice on a multisite install.

== Screenshots ==

1. Guided setup: connect your WordPress website to Tuurio ID step by step.
2. Choose guided setup or connect an existing client manually.
3. Create a Tuurio ID account during setup. Email and password are hidden; names shown are fictional demo data.
4. Connection overview with all nine checks passed and the client secret hidden.
5. Use Tuurio ID only: disable the standard WordPress password sign-in.
6. WooCommerce settings: admit new customers immediately and assign the Customer role.
7. A demo shopping cart with two products before signing in.
8. Sign in or register with Tuurio ID to continue to checkout.
9. Tuurio ID offers passkey setup after registration.
10. WooCommerce explains that the account email address is managed by Tuurio ID.
11. Manage sign-in methods in the external Tuurio ID service, including passkeys and TOTP.
12. The external Tuurio ID administration assistant guides the initial setup.
13. Setup progress in Tuurio ID: application connection and access completed, branding still open.

== Support ==

For help with the plugin or the connected Tuurio ID service, contact [wpsupport@tuurio.com](mailto:wpsupport@tuurio.com).

Include your WordPress, PHP and plugin versions, the affected integration, the steps to reproduce the problem and the visible error message. Do not send passwords, client secrets, tokens or unredacted diagnostic logs.

The plugin handles sign-in and account linking. For orders, payments, shipping or other shop features, contact the relevant plugin's support team.

== Third-party resources ==

* Icons: [Lucide](https://lucide.dev), bundled inline as SVG (ISC license; the subset derived from the Feather project is additionally MIT-licensed, Copyright (c) 2013-present Cole Bemis). No network or font dependency. Full license text: `licenses/lucide-LICENSE.txt` in the plugin folder.
