App users and sign-in

Phone, email or both

On App sign-in, under How people sign in, choose:

• Phone number: a 6-digit code on WhatsApp. The default.
• Email address: with no website or with content in the dashboard, a 6-digit code by email, sent in your app's name. New people sign up with their email address. On WordPress, you choose how email works (see below).
• Phone number or email address: the app shows a Phone / Email switch.

Apps connected to Shopify, ikas, Ticimax, IdeaSoft or SimplyBook.me sign in by phone: those platforms find each customer's orders and bookings by their phone number. Apps connected to Teachable or Thinkific can also sign in by email: someone who signs in by email sees the courses of their school account with that address, including courses bought on your website.

On WordPress, choose how email sign-in works:

• With a code by email: anyone can sign up. People get a 6-digit code by email. Someone without an account on your website gets one, with the details you ask for, when the plugin's Allow new accounts to sign up from the app is on. Accounts that can edit your website (staff) never sign in by code: they sign in on the website. Needs version 0.3.5 or later of the Yallapp plugin.
• With their password: existing accounts only. The email address and password of their account on your website; WordPress checks the password, and "Forgot your password?" opens your website's reset page. New people sign up by phone or on your website.

Your website gets your choices within a minute when it can be reached, otherwise at its next check (twice a day). Check now in the Yallapp plugin gets them at once. They override the plugin's own Sign-in settings; until you choose here, those apply.

Your store review number always signs in, also when the app signs in by email only. When it signs in by email only, the app shows no phone field, so also set a store review email address (see below).

If you change where your app's content comes from to Shopify or another connected platform, the app signs in by phone only. The Website step warns you first when customers signed up with their email address: they can't sign in after the change.

The WhatsApp number that sends codes

Codes go out from Yallapp's WhatsApp number, with your app's name. To send them from your own WhatsApp number instead, open a WABEK account at waabek.com, connect your number there, then on App sign-in paste your WABEK API key and the Instance ID of that number, and select Send a test code. The key is stored encrypted and never shown again. Use Yallapp's number again goes back to ours.

On WordPress, this applies when the plugin's Sign-in codes are sent by setting is Sent by Yallapp (WhatsApp).

If your number can't send a code (WABEK doesn't answer, or the number is disconnected), that code goes out from Yallapp's number instead, so your customers still get it. We email you, at most once a day, and App sign-in shows the day it happened until you save a new key or a test code goes out.

Send your app's emails from your own address

Emails to the people using your app, like email sign-in codes, go out from Yallapp's address with your app's name. To send them from your own address, like hello@your-site.com, open App sign-in, go to Your app's email, choose My own email server and pick your email service. The server settings are filled in for you; follow the steps shown for your service:

Google (Gmail or Google Workspace: smtp.gmail.com, 465 with SSL/TLS or 587 with STARTTLS)

1. Turn on 2-Step Verification for the Google account that will send the emails: in your Google Account, open Security.
2. Make an App password: in your Google Account, search for "App passwords", type a name such as your app's name, and copy the 16-letter password Google shows. Google shows it only once.
3. Here, type your full Gmail or Google Workspace address as the username and paste the App password as the password.
4. Send from the same address, or from an address you added in Gmail under "Send mail as". Google replaces other From addresses with your own.
5. Gmail sends up to about 500 emails a day, Google Workspace about 2,000.

Microsoft (Outlook.com or Microsoft 365: smtp.office365.com, 587 with STARTTLS)

1. Type your full Outlook.com or Microsoft 365 address as the username.
2. Microsoft 365 (a work or school account): your administrator must turn on Authenticated SMTP for this mailbox, in the Microsoft 365 admin center: Users, Active users, the mailbox, Mail, Manage email apps.
3. If the account uses two-step verification (MFA), make an app password in the security settings of your Microsoft account and use it here.
4. Microsoft is turning off password sign-in for email programs on more accounts. If the test keeps saying the sign-in failed although the password is right, ask your administrator, or use another email service.
5. Send from the mailbox's own address. Microsoft refuses other From addresses unless the mailbox may send as them.

Zoho Mail (Accounts at zoho.com: smtp.zoho.com, 465 with SSL/TLS or 587 with STARTTLS)

1. Use your full Zoho Mail address as the username.
2. If your Zoho account has two-factor authentication on, make an app password: in Zoho Accounts, open Security, then App Passwords, and create one for this app. Use it here instead of your usual password.
3. With a paid Zoho plan for your own domain, Zoho may ask you to use smtppro.zoho.com instead: change the server under "Server settings".
4. Send from your Zoho address or an alias set up in Zoho Mail. Zoho refuses other From addresses.

Zoho Mail (EU) (Accounts at zoho.eu: smtp.zoho.eu, 465 with SSL/TLS or 587 with STARTTLS)

1. Use your full Zoho Mail address as the username.
2. If your Zoho account has two-factor authentication on, make an app password: in Zoho Accounts, open Security, then App Passwords, and create one for this app. Use it here instead of your usual password.
3. With a paid Zoho plan for your own domain, Zoho may ask you to use smtppro.zoho.eu instead: change the server under "Server settings".
4. Send from your Zoho address or an alias set up in Zoho Mail. Zoho refuses other From addresses.

Yandex (Yandex Mail or Yandex 360: smtp.yandex.com, 465 with SSL/TLS)

1. In Yandex Mail, open Settings, then "Email clients", and allow access to the mailbox from email clients with app passwords.
2. Make an app password: in your Yandex ID, open Security, then App passwords, choose Mail and copy the password.
3. Here, type your full Yandex address as the username and paste the app password as the password.
4. Send from your Yandex address. Yandex refuses other From addresses.

Other (Your web host or another email service)

1. Ask whoever runs your email (your web host, your email service or your IT person) for its SMTP settings: the server, the port, the security, the username and the password.
2. Port 465 usually goes with SSL/TLS, and port 587 with STARTTLS.
3. Send from an address of that mailbox. Most email services refuse other From addresses.

Then type the username and password, the From name people see (usually your app's name) and the From address, and save. The password is stored encrypted and never shown again; leave it blank later to keep it. Use the mailbox's own address as the From address: many services refuse other addresses, and the page warns you when it differs from the username. A Reply-to address is optional.

Select Send a test email and check that it arrives (look in the spam folder too). If it doesn't, the page says why in plain words: the username or password was refused, the server couldn't be found or didn't answer, or the secure connection failed.

If your server can't send an email later, that email goes out from Yallapp's address instead, so nobody misses a code. We email you, at most once a day, and Your app's email shows the day and the reason until you save the settings again or a test email goes out. Emails to you and your team always come from Yallapp. On WordPress, this is for the codes Yallapp emails for your website; your website's own emails still come from WordPress. With your own API, your API sends its own emails.

How a phone sign-in works

1. They enter their phone number, with the country code.
2. We send a 6-digit code. It's valid for 5 minutes, a new one can be asked for after a minute, and a code allows a few attempts.
3. They type the code. A new number can create an account with the details you ask for.

How the code is sent depends on where your content comes from:

• Shopify, ikas, Ticimax, IdeaSoft, Teachable, Thinkific, SimplyBook.me or no website: we send it on WhatsApp, through waabek.com.
• WordPress: we send it on WhatsApp too (or Digits does, through your own gateway, if you choose it in the plugin), and people use the same accounts as on your website.
• Your own API: your API sends it, from your own system.

The sign-in rules

For apps without a website, or connected to another platform, the rules are on the dashboard's App sign-in page:

• New customers can sign up in the app, and whether to ask for their email or city
• Country code shown first on the sign-in screen, like 90 for Turkey
• Devices per customer: a customer at the limit signs out on another device first; 0 means no limit
• Support WhatsApp shown in the app, and your Terms page
• App store review: a review phone number, a review email address and a fixed review code for Apple and Google (see below)

Changes apply right away, without a new build. On WordPress, the same rules are in the Yallapp plugin's Sign-in settings.

Access for store reviewers

Apple and Google reviewers must be able to sign in, and they can't receive your codes. Set a review phone number and a fixed code, and give both to the stores: under App access in Google Play Console, and under App Review Information in App Store Connect. Without it, your app may be rejected. When your app signs in by email only, set a review email address too and give the stores that address with the code: the app shows them no phone field. No email or message is sent to either. Add them to For the store reviewers on Publishing when our team publishes for you.

On WordPress, the same is in the plugin's Store review access settings: a test number, a test email address and a fixed code. With email sign-in, reviewers type the test email address and the fixed code as the password. Use an address that isn't one of your staff's accounts.

Deleting an account

People can delete their account from the app's settings, as Apple and Google require. Their sign-in and devices are removed.