Secure every login. Verify every identity.
ShoSecureAuth is a WHMCS addon that lets clients and administrators sign in with a passkey, and asks for a one-time code after a password when you require it. Email, WhatsApp, an authenticator app, and backup codes are configured separately for the client area and the admin area. It installs as a standard WHMCS addon and is sold on its own.
One domain-bound WHMCS install with passkeys, OTP two-factor, and in-module updates. Start with a 15-day trial from the License tab in the addon, or purchase from ShoHost.
ShoSecureAuth license
Passkeys, OTP channels, and admin controls for WHMCS client and staff logins.
Clients and admins sign in with a device biometric or a security key. No password on that path.
Passkeys, passkey management, and OTP after password are switches for each area.
Codes go through WHMCS system mail, or through SMTP you set only for these codes.
Send codes with the ShoHost WhatsApp addon, or with your own MPWA URL, API key, and sender.
Google Authenticator-style TOTP. Admins enroll on My Account. Clients enroll on the Security page.
One-time codes when a person cannot use OTP or the authenticator app.
Primary email and phone come from the account. Users can add up to 5 extra emails and 5 extra WhatsApp numbers.
Remember a device for a number of days you set. Users can revoke trusted devices themselves.
A registered admin passkey can confirm sensitive admin actions in place of typing the password again.
See who has passkeys, which 2FA methods are on, and how many devices are trusted. Staff can remove a passkey or reset 2FA.
Login counts, failed attempts, and an activity log. Health checks cover the license, HTTPS, RP ID, and login template.
License tab plus an Updates tab that pulls new releases for this install.
Admin settings, client security, and login flows from a licensed ShoSecureAuth install on WHMCS.
ShoSecureAuth header with users, passkeys, logins in 24 hours, and failed logins.
Client area and administrator switches for passkey login, manage passkeys, and OTP after password.
Email, WhatsApp, authenticator app, and backup codes, split into Administrator 2FA and Client 2FA.
Email subject and HTML body, WhatsApp message, WHMCS mail versus custom SMTP, ShoHost WhatsApp versus MPWA.
RP ID, display name, challenge lifetime, user verification.
Max passkeys, passkey button visibility, remember-device days, rate limit, activity retention.
Account, type, passkey count, 2FA pills, trusted devices, reset actions.
Where codes are sent, passkey list, authenticator enrollment, backup codes, revoke trusted devices.
Client or admin login with the passkey button.
WHMCS administrator login
Password reuse and stolen mailbox access are how WHMCS client and admin accounts get taken over. ShoSecureAuth adds a second check after the password, and a passkey path that does not send the password at all.
Answers about licensing, passkeys, OTP channels, and refunds. [email protected] · +91 94880 91432
No. It is sold separately and is not part of reseller, master, alpha, or lifetime hosting.
One domain-bound WHMCS install: passkeys, OTP, the admin screens, and module updates for $3.00/mo on this page.
Yes. Passkey login, passkey management, and OTP after password are separate switches for the client area and the administrator area.
A passkey is its own sign-in. OTP is an extra step after the password, and it runs only when that switch is on and at least one channel (email, WhatsApp, authenticator app, or backup codes) is enabled.
Only if you want WhatsApp codes and you do not already have an MPWA gateway. Email codes and authenticator codes do not need it.
Set the RP ID to the registrable domain, such as example.com. Passkeys then work on subdomains of that domain. The site must be served over HTTPS.
They can use a backup code if you enabled them, another registered passkey, or an extra email or WhatsApp number they added. Staff can also reset that user from the Users tab.
7-day refund on eligible module orders, same as the other ShoHost module pages (/system-policies/).
WHMCS modules hub · ShoHost WhatsApp module (optional, for WhatsApp OTP) · [email protected]