1 Get your Client ID and Secret
Every site that uses Sign in with ZapQR needs its own credentials. They're free and self-serve:
Go to auth.zapqr.ai/account and sign in — the first time, that just means entering your email and clicking the magic link we send you. Once you're in, add a passkey so future sign-ins are one touch.
Under Your sites, choose your platform (WordPress, Shopify, or Custom), enter your site's URL, and click Add site. You'll get a Client ID and a Client Secret.
For WordPress sites, the redirect URL is derived automatically from your site URL — you don't need to configure it. For other platforms, paste the redirect (callback) URL your plugin shows you.
2 WordPress
Install ZapQR Login from the WordPress plugin directory (version 1.1.0 or later) — in your admin, Plugins → Add New, search "ZapQR Login", install and activate.
Then in Settings → ZapQR Login:
- Paste your Client ID and Client Secret from step 1.
- Leave the Identity Provider as
https://auth.zapqr.ai. - Optionally enable Link Existing Users so people who already have a WordPress account with the same (verified) email get connected to it instead of a new account.
That's it — your login page now shows a Sign in with ZapQR button. New visitors are provisioned with your default role; signing out of WordPress also signs them out of ZapQR for that site.
Requires WordPress 5.8+ and HTTPS on your site.
3 Drupal
Install the OpenID Connect / OAuth client module, then add a Generic OAuth 2.0 client:
- Client ID / Client secret: from step 1 — when adding your site at auth.zapqr.ai, choose Custom, paste the redirect URL Drupal shows you (it looks like
https://yoursite.com/openid-connect/<name>), and set the token auth method to client_secret_post. - Authorization endpoint:
https://auth.zapqr.ai/auth - Token endpoint:
https://auth.zapqr.ai/token - UserInfo endpoint:
https://auth.zapqr.ai/me - Scopes:
openid email
Enable the client, and the OpenID Connect login option appears on your Drupal login form.
4 Any OpenID Connect platform
ZapQR is a standard OpenID Connect provider — Ghost, Discourse, Grafana, Nextcloud, and most SaaS admin panels can consume it with their OIDC / SSO plugin. Most tools only need the discovery URL:
| Setting | Value |
|---|---|
| Issuer | https://auth.zapqr.ai |
| Authorization | https://auth.zapqr.ai/auth |
| Token | https://auth.zapqr.ai/token |
| UserInfo | https://auth.zapqr.ai/me |
| JWKS | https://auth.zapqr.ai/jwks |
| End session (logout) | https://auth.zapqr.ai/session/end |
| Scopes | openid email profile |
| Flow | Authorization code (PKCE S256 supported) |
| Token auth | client_secret_basic (default) or client_secret_post — selectable per site |
| Claims | sub, email, email_verified, name |
Refresh tokens and RP-initiated logout are supported. Every account's email is verified before your platform ever sees it, so email_verified is honest.
What your visitors experience
They click Sign in with ZapQR and land on auth.zapqr.ai. First-timers enter their email and click a magic link — that's the whole signup. Then they're offered a passkey, so every sign-in after that is Face ID or Touch ID, no typing.
They approve sharing their email with your site once, then return signed in. No password ever existed, so there's nothing for your database to leak and nothing for a phishing page to steal.
Coming next: QR device-link sign-in (scan with your phone to sign in on a TV, kiosk, or shared machine) and push-to-approve — your integration gets both automatically, no changes needed.
Stuck, or on a platform we haven't documented?
If your platform speaks OIDC, we'll get you running. Shopify support for new customer accounts is in the works.