Warp

Warp makes a Craft site's front-end member area passwordless. Members sign in with a magic link, a short emailed code, or a passkey. There are no passwords to create, forget, reset, or leak.

Three ways in, one email field

• Magic links. A single-use, rate-limited, enumeration-safe sign-in link. The email states exactly how long it lasts.
• One-time codes. A short numeric code typed into a paste-aware segmented input, with a per-code attempt cap.
• Passkeys. Members enroll, name, and remove passkeys from their account screen, then sign in with Face ID, Touch ID, Windows Hello, or a hardware key. A configurable nudge invites members to add one after signing in.

Registration works from the same form: an unknown address gets a sign-up link instead of an error, so the login page never leaks whether an account exists.

A complete member area, ready to restyle

One console command copies a full set of member templates into your project: login, code entry, account, passkeys, and sessions pages, styled and working. They are yours to edit.

When you outgrow them, Warp's four render builders (requestForm(), otpForm(), otpInput(), and passkeyButton()) let you pass your own classes and attributes into every element they emit, override every string, or turn Warp's CSS off entirely. Warp's stylesheet lives in a warp cascade layer, so your site's rules win. And if you want to write every tag yourself, the code input's DOM contract is documented: add three data attributes to your own markup and Warp's behavior attaches to it, with zero class names of its own.

Sessions, devices, and location

Members see their active sessions with device and location, can sign out any single device, or sign out everywhere else with one click. Warp can flag sign-ins from a new location with a badge in the control panel and an optional alert email, keeps sign-in history for 90 days, and can anonymize stored IP addresses.

Built for real sites

• Return URLs are validated per site, so a multi-site install never redirects a member across sites.
• All emails are Craft system messages: edit the copy per site and language, or restyle them with an HTML email template.
• Rate limits on every endpoint, per address and per code.
• Control panel settings support environment variables, project config, read-only mode, and a dedicated permission.
• A privacy page in the docs spells out what Warp stores, for how long, and what to put in your privacy policy.

Warp requires Craft CMS 5.10 or greater and PHP 8.2 or greater.