Chatbot

View All Docs

Mobile App Pwa (5)

Sign-In Security and User Profiles

Reading Time: 3 minutes
Download Markdown

Overview

The WPiko Chatbot Pro Mobile App uses WordPress’s own account security instead of a separate login system. Users sign in with their WordPress username and an Application Password. Only Administrators and Live Agents can use the app.

Who Can Sign In

  • Administrators
  • Live Agents: a role added by WPiko Chatbot Pro for support staff (previously called “WPiko Agent”)

WPiko Chatbot Pro gives both roles the Mobile App permissions: access the app, view conversations, reply, manage live takeovers and manage push notifications.

Sign-In Method

The app asks for your WordPress username and an Application Password. It never uses your normal WordPress password. This keeps your main password safe and lets you revoke app access without changing it.

Security Behavior

  • HTTPS required on live sites. Local and development sites are allowed without it.
  • Same-origin access: the app’s API only accepts requests from the app on your own site.
  • Brute-force protection: repeated failed sign-in attempts are throttled.
  • Session storage: by default the password is kept only for the current browser session. With Remember me on this device, it stays saved until you log out.

Revoking Access

If a device is lost or replaced:

  1. Go to Users → Profile → Application Passwords.
  2. Revoke the password created for that device.

Access is blocked immediately. Create a separate Application Password for each device so you can revoke one without affecting the others. Also remove the device from the push notification list in Pro Features → Mobile App.

Name and Avatar Shown to Visitors

When a team member takes over a conversation, visitors see their WordPress public display name (Users → Profile → Display name publicly as), for example “Maria” or “John from Sales”. If none is set, WordPress uses the username.

The avatar comes from WordPress’s avatar system: Gravatar for the account’s email, or a local avatar plugin. If neither is available, an initial-based avatar is shown.

Troubleshooting Sign-In

“Authentication failed”

  • Use your WordPress username, not your email address.
  • Use an Application Password, not your normal password.
  • Check that the account is an Administrator or Live Agent, the Mobile App is enabled, and the Pro license is active.

“Access denied”

The sign-in worked, but the account doesn’t have Mobile App permissions. Give the user the Live Agent or Administrator role.

Best Practices

  • Use one Application Password per device, and revoke old ones.
  • Give each team member their own account with a clear display name.
  • Use the Live Agent role for staff who don’t need full admin access.
Have a Question?