QuickAuth – Checkout Login Without Password

SMS providers

The login code by SMS is optional. Three providers are available for delivery: the commercewerk gateway (default), Twilio and Vonage. Each provider has its own card in the settings with the matching credential fields.

Choosing a provider

  • In the SMS provider card you choose which service sends login codes by SMS: commercewerk (default), Twilio or Vonage.
  • Only the selected provider's card takes effect – credentials in the other cards have no effect.
  • Each provider card has a Verify API Credentials button that tests the entered credentials directly against the provider – so you can see the connection works before the first customer login.

commercewerk SMS

  • API URL: fixed to https://sms-gateway.commercewerk.de/api and not editable.
  • API Token: the access token for the commercewerk gateway.

Get the API token for commercewerk SMS

Register at https://commercewerk.de/dashboard. The dashboard is also linked in the website footer.

  1. In the dashboard, open the QuickAuth menu item, or go directly to https://commercewerk.de/dashboard/manage/solutions/quick-auth.
  2. Select Create Your First Configuration and enter a Configuration name, for example "Production". The API token appears as soon as the name is entered (the dashboard labels it Shopware plugin key).
  3. Copy the API token with the copy button and save the configuration. Leave Enabled switched on: a disabled configuration sends no SMS and charges nothing.
  4. In the extension's commercewerk SMS card, paste the API token into API Token and press Verify API Credentials. The notification "The API credentials are valid, and the connection was successfully established." confirms the connection.
The commercewerk dashboard with the QuickAuth menu item
The commercewerk dashboard with the QuickAuth menu item.
The QuickAuth view with the Create Your First Configuration button
The QuickAuth view with the "Create Your First Configuration" button.
The commercewerk SMS card showing the API Token field and Verify API Credentials button
The commercewerk SMS card with the "API Token" field and "Verify API Credentials" button.
The success popup confirming valid API credentials and a successful connection
The success popup after the API credentials are verified.

Cost

Each SMS costs €0.12 to send. New customers receive a €2 welcome credit to try the service. You can create several tokens for one account, for example separate tokens for production and development. All tokens are billed to the same dashboard account.

Twilio

The SMS Twilio card with Account SID, Auth Token and Twilio Region & Edge
The "SMS Twilio" card with its credential fields.
  1. Sign up for Twilio or log in to your existing account.
  2. In the Twilio console, find your Account SID and Auth Token.
  3. Paste them into the matching fields in the SMS Twilio card.
  • Twilio Region & Edge (default: "US (us1) via Ashburn"): sets which Twilio region and edge location requests are routed through. Also available: "US (us1) via Umatilla", "US (us1) via Roaming (auto)", "Ireland (ie1) via Dublin" and "Australia (au1) via Sydney".

Vonage

The SMS Vonage card with API Key and API Secret
The "SMS Vonage" card with its credential fields.
  1. Sign up in the Vonage Developer Portal or log in to your existing account.
  2. In the Vonage dashboard, find your API Key and API Secret.
  3. Paste them into the matching fields in the SMS Vonage card.
  • API Key and API Secret: the credentials from the Vonage dashboard.

Sender name and message text

The SMS Message card holds two snippets, editable per language:

  • Sender (default: "YourShop"): the alphanumeric sender ID the customer sees on the SMS. Put your shop name here. Not every country allows a name as sender; if in doubt, ask your SMS provider about your destination countries.
  • Message text (default: "Your login code is %otpCode%. Please do not share this code with anyone."): the text of the SMS; the %otpCode% placeholder inserts the login code.
Keep the login-code placeholder

Keep %otpCode% in the message text. Without it, the SMS carries no login code.

Two things are called "sender"

The selection in the SMS provider card determines the service that sends the SMS. The Sender in the SMS Message card is the name the customer sees as the sender on their phone.

Allowed countries and the input field

  • Allow login via mobile number: the country allowlist. Customers can only log in with mobile numbers whose country code belongs to one of the selected countries (default: Germany, Austria, Switzerland, Netherlands, France, United Kingdom, United States, Poland, Czech Republic, Belgium, Italy, Spain, Sweden, Denmark). The list is also enforced server-side. It checks the number's country code, not the customer's current location: a German number used from France still receives a login code when Germany is on the list.
  • Priority order for country list (default: Germany, Netherlands): these countries are pinned to the top of the input field's country dropdown.
  • Further options control the input field in detail – country dropdown, country search, flags, automatic formatting as the customer types, national format and the display of the dial code. The full list with defaults is in the Configuration chapter.