Developer documentation

OEngage v1.0.0

Comprehensive WordPress user registration, authentication, and engagement — custom auth pages, social login, magic links, 2FA, gamification, badges, and a persistent utility bar.

WordPress plugin WP 5.8 · PHP 7.4+ GPL-2.0+ Released 2025-04
01 · Overview

What OEngage does

Replaces the default WordPress login and register system with a modern, fully-featured alternative — and layers gamification and community features on top.

🔐
Custom Auth Pages
Sign in, register, forgot/reset password — fully custom pages
🌐
Social Login
Google, Apple, GitHub, LinkedIn OAuth
✉️
Magic Link
Passwordless sign-in via secure email link
🔒
Two-Factor Auth
TOTP (Google Authenticator) + email code
XP + Levels
Configurable actions, 8 default levels, automatic recalculation
🔥
Login Streaks
Daily streak tracking with longest-streak record
🏅
Badge System
Manual + automatic (XP threshold, streak) badge conditions
🏆
Leaderboard
5-minute cached top-XP ranking, shortcode-embeddable
📊
Utility Bar
Persistent fixed bar — XP, streak, notification bell, profile dropdown
👤
User Profiles
Avatar upload, bio, privacy controls, completeness indicator
👥
Follow System
Follow/unfollow users with follower/following counts
💬
Direct Messaging
Basic user-to-user messaging
02 · Installation

Getting installed

1
Upload the oengage folder to /wp-content/plugins/.
2
Activate through Plugins → Installed Plugins.
3
On activation: creates 10 custom database tables, creates 4 pages (Sign In, Create Account, My Profile, My Dashboard), and sets sensible defaults for all settings.

Requirements

WordPress
5.8+
PHP
7.4+
8.0+ recommended
MySQL
5.7+
MariaDB 10.3+
Extension
OpenSSL*
Required for 2FA TOTP
03 · File Structure

Plugin architecture

oengage/ ├── oengage.php Plugin bootstrap ├── uninstall.php Cleanup on delete ├── includes/ │ ├── Core/ │ │ ├── Autoloader.php PSR-4 class autoloader │ │ ├── Plugin.php Plugin singleton + boot │ │ ├── DB.php Table creation SQL │ │ └── Installer.php Activation: tables + pages + defaults │ ├── Admin/ │ │ ├── AdminMenu.php WP admin menu + all handlers │ │ └── Controllers/ │ │ ├── UserController.php User list + single user view │ │ ├── BadgeController.php Badge CRUD │ │ ├── GamificationController.php XP actions + levels + naming │ │ ├── EmailController.php Email template editor │ │ └── SettingsController.php All plugin settings │ ├── Auth/ │ │ ├── AuthHandler.php Login/logout AJAX + redirect │ │ ├── MagicLink.php Passwordless magic link │ │ ├── TwoFactor.php TOTP + email code 2FA │ │ ├── BruteForce.php Rate limiting + lockout │ │ ├── SessionManager.php Session tracking table │ │ └── SocialAuth.php Google, GitHub, LinkedIn OAuth │ ├── Registration/ │ │ ├── RegistrationHandler.php AJAX register + captcha + approval │ │ └── FieldBuilder.php Configurable registration fields │ ├── Profile/ │ │ ├── ProfileController.php Email verify + profile save + avatar │ │ └── ProfileRepository.php Profile data + completeness + privacy │ ├── Gamification/ │ │ ├── XPEngine.php Award XP + activity log + level sync │ │ ├── BadgeEngine.php Award badges + condition checking │ │ ├── StreakEngine.php Login streak tracking │ │ ├── LevelEngine.php Level calculation + progress │ │ └── Leaderboard.php Cached leaderboard query + shortcode │ ├── Notifications/ │ │ ├── NotificationEngine.php In-plugin notifications (bell) │ │ └── EmailNotifier.php Transactional email send + templates │ ├── UtilityBar/ │ │ └── UtilityBar.php Frontend sticky bar (XP, streak, notifs, dropdown) │ ├── Social/ │ │ ├── FollowSystem.php Follow/unfollow + counts │ │ └── Messaging.php Direct user-to-user messaging │ └── API/ │ └── RestController.php /wp-json/oengage/v1/ endpoints ├── templates/ │ ├── admin/ Admin views: users, badges, gamification, emails, settings │ └── frontend/ sign-in, create-account, forgot-password, my-profile, my-dashboard └── assets/ ├── css/or-admin-v1.css + or-frontend-v1.css └── js/or-admin-v1.js + or-frontend-v1.js
04 · Database Tables

10 database tables

All prefixed with {prefix}or_. Created on activation.

TablePurpose
or_activityEvery XP-earning action per user — action key, object ID, XP earned, JSON data, timestamp
or_xpDenormalized XP totals for leaderboard performance — total_xp, level, updated_at (PK = user_id)
or_badgesAdmin-defined badges — name, description, icon, condition_type, condition_value, xp_reward
or_user_badgesJoin table: which users earned which badges. UNIQUE KEY on (user_id, badge_id)
or_sessionsActive login sessions — SHA-256 token hash, device info (UA), IP, last_active (auto-updated)
or_login_attemptsBrute force protection — tracks failed attempts by IP + email
or_notificationsIn-plugin notification bell entries — type, message, read_at, JSON data
or_followsFollow/unfollow relationships between users
or_messagesDirect user-to-user messages
or_2faPer-user 2FA config — secret, method, trusted devices
05 · Admin Interface

Admin interface

Takes over the full browser viewport (position: fixed) so the WordPress sidebar never interferes. Matches the Orravo design system used across all Orravo plugins.

TabURL paramPurpose
Userstab=usersUser list with stats, search, filter, CSV export
Badgestab=badgesBadge list + create/edit
Gamificationtab=gamificationXP actions, levels, naming configuration
Emailstab=email-templatesPer-template visual email editor
Settingstab=settingsAll plugin configuration

Single user view

Click any user row to open a full profile card: XP, level, streak, level progress bar, profile completeness. From this view admins can award XP (amount + reason), award a badge from a dropdown, view earned badges grid, see recent activity, manage active sessions, impersonate the user, or delete the account.

06 · Settings Reference

Settings reference

All settings stored in wp_options under key oe_settings.

Page assignments

KeyTypeDescription
login_pageintWP page ID for login
register_pageintWP page ID for registration
profile_pageintWP page ID for user profiles
dashboard_pageintWP page ID for user dashboard
profile_slugstringURL prefix e.g. members/members/username

Authentication features

KeyDefaultDescription
enable_magic_linktruePasswordless email login
enable_2fafalseTOTP + email code 2FA
brute_force_limit5Max failed attempts before lockout
brute_force_window15Lockout window in minutes

Registration

KeyDescription
registration_approvalRequire admin approval before account activates
enable_invitation_codesRequire invite code to register
email_whitelistAllowed email domains (newline-separated)
enable_captchaEnable CAPTCHA on registration form
captcha_typerecaptcha_v3 or hcaptcha

Utility bar

KeyDefaultDescription
utility_bar_enabledtrueShow utility bar on frontend
utility_bar_show_xptrueShow XP counter
utility_bar_show_streaktrueShow streak counter
utility_bar_show_notiftrueShow notification bell
utility_bar_bg_color#0b0b0cBar background colour
utility_bar_text_color#ececedBar text colour
07 · Shortcodes

Shortcodes

[oengage_login]
Renders the full login form — social buttons, magic link option, and 2FA prompt.
[oengage_login]
[oengage_register]
Renders the registration form with all configured fields, CAPTCHA, and invitation code input.
[oengage_register]
[oengage_profile]
Renders the user profile page. Reads ?user=username from the URL to show other users' profiles.
[oengage_profile]
[oengage_dashboard]
Renders the logged-in user dashboard with stats, activity feed, badges, and notifications. Redirects to login if not authenticated.
[oengage_dashboard]
[oengage_leaderboard]
Renders a leaderboard table. Cached for 5 minutes via transient.
[oengage_leaderboard type="xp" limit="10"]
AttributeDefaultOptions
typexpxp
limit101–50
[oengage_badges]
Renders a badge showcase for a user.
[oengage_badges user_id="123"]
[oengage_member_only]
Wraps content so it only renders for logged-in users.
[oengage_member_only]
  This content is for members only.
[/oengage_member_only]
08 · Authentication System

Auth system

AJAX-powered login flow with brute force protection, 2FA gate, and automatic session + gamification hooks on success.

1
User submits email + password via AJAX (or_login action).
2
BruteForce::is_locked() checks for too many recent failed attempts.
3
wp_authenticate() verifies credentials.
4
If 2FA is enabled for the user, a pending token is returned and the 2FA form shown.
5
On success: wp_set_auth_cookie(), session created, XP awarded for daily login, streak recorded, oengage_login action fired.

AJAX actions

ActionHandlerAuth required
or_loginAuthHandler::ajax_loginnopriv
or_forgot_passwordAuthHandler::ajax_forgot_passwordnopriv
or_reset_passwordAuthHandler::ajax_reset_passwordnopriv
or_logout_sessionAuthHandler::ajax_logout_sessionlogged-in
09 · Social Login

Social login

Four OAuth providers — configure credentials in Settings → Social Authentication.

OAuth callback URL

https://yoursite.com/?or_oauth_callback={provider}
// provider = google | github | linkedin | apple

Email already exists

If the email from a social provider already exists as a WP user: OEngage logs in that user automatically (no error), stores the provider's user ID in user meta (oe_social_google, etc.), and sends a "Social login added" notification email.

11 · Two-Factor Authentication

Two-factor auth

TOTP (Google Authenticator)

  • Standard RFC 6238 TOTP — compatible with Google Authenticator, Authy, 1Password
  • Pure PHP implementation — no external library dependency
  • 32-character base32 secret stored per user in or_2fa table
  • ±1 code window (30-second tolerance)

Email code

6-digit numeric code sent to user's email address. 10-minute expiry via WordPress transient.

Setup flow (user-side)

1
User navigates to profile page and requests 2FA setup.
2
AJAX action or_setup_2fa generates a secret and returns an otpauth:// QR URI.
3
User scans QR code in their authenticator app, enters the current code to confirm.
ℹ️To disable a user's 2FA as an admin, remove their oe_2fa_enabled and oe_2fa_secret user meta. 2FA status is visible in the single user view.
12 · Brute Force Protection

Brute force protection

Tracks failed login attempts in or_login_attempts by both IP address and email simultaneously.

TriggerDefaultConfigurable
Failed attempts before lockout5Settings → brute_force_limit
Lockout window15 minutesSettings → brute_force_window

On successful login, all login attempts for that email are cleared from the table.

13 · Session Management

Session management

Every login session is tracked in or_sessions with a SHA-256 hashed token, device info, IP address, and auto-updating last-active timestamp.

  • Admins can view all sessions for a user in the single user view
  • Sessions can be revoked individually (or all at once) from the admin
  • Users can revoke their own sessions via AJAX (or_revoke_session)
  • Programmatic revocation: SessionManager::revoke_all( $user_id )
14 · Registration System

Registration system

1
POST to or_register with email, password, first/last name.
2
Validation: email format, email uniqueness, password length ≥ 8.
3
Email domain whitelist check (if configured).
4
Invitation code check (if configured).
5
CAPTCHA verification (reCAPTCHA v3 or hCaptcha, if configured).
6
wp_insert_user() creates the account.
7
If approval mode: pending meta set, admin notified. Otherwise: verification token created (24h), email sent with verify link.
8
XP awarded for register action. oengage_user_registered action fired.

Default registration fields

KeyTypeRequired
first_nametextYes
last_nametextYes
emailemailYes
passwordpasswordYes

Fields configured in wp_options key oe_registration_fields. Custom fields can be added programmatically or via a future admin UI.

15 · User Profiles

User profiles

Profiles are at the page assigned to profile_page in settings. Pass ?user=username to view another user's profile.

User meta keys

Meta keyDescription
oe_email_verifiedbool — email verified
oe_avatar_idAttachment ID for custom avatar
oe_profile_privacypublic / members / private
oe_login_streakCurrent login streak count
oe_longest_streakAll-time longest streak
oe_last_login_dateY-m-d format
oe_last_activeDatetime
oe_2fa_enabledbool
oe_2fa_secretTOTP secret

Profile completeness & privacy

ProfileRepository::get_completeness() returns 0–100% based on four checks: display name set, bio filled in, custom avatar uploaded, email verified. Prompts shown on dashboard if < 100%.

Privacy valueWho can see the profile
publicEveryone including logged-out visitors
membersLogged-in users only
privateOnly the user themselves
16 · Gamification Engine

Gamification engine

XP is stored in or_xp (not user meta) for leaderboard query performance. Level is recalculated and synced every time XP is awarded.

Default XP actions

Action keyLabelDefault XP
registerRegister50
loginDaily Login5
fill_profileComplete Profile30
post_commentComment10
create_postPublish Post25
follow_userFollow a User5
send_messageSend a Message3

Daily login XP is only awarded once per calendar day, checked via oe_last_xp_login user meta.

Default levels

Level 1
Newcomer
0 XP
Level 2
Member
100 XP
Level 3
Regular
300 XP
Level 4
Active
700 XP
Level 5
Veteran
1,500 XP
Level 6
Expert
3,000 XP
Level 7
Master
6,000 XP
Level 8
Legend
12,000 XP

Level names and XP thresholds are fully configurable in Gamification → Levels.

Streak system

StreakEngine::record_login() is called on every successful login. Streak increments if last login was yesterday; resets to 1 if the gap is more than 1 day. Longest streak is tracked separately in oe_longest_streak user meta.

17 · Badge System

Badge system

Condition typeDescription
manualAdmin awards only — no automatic trigger
xp_thresholdAutomatically awarded when user's total XP reaches the condition value
login_streakAwarded when streak count reaches the condition value

BadgeEngine::check_conditions() is called every time XP is awarded — it queries all active non-manual badges and awards any the user now qualifies for. Duplicate prevention: or_user_badges has a UNIQUE KEY on (user_id, badge_id).

18 · Utility Bar

Utility bar

A persistent position: fixed bar rendered at the top of every frontend page via wp_body_open. Uses z-index: 99990 — below the WP admin bar (99999) but above all site content.

StateWhat's shown
Logged inXP counter (configurable) · Streak counter (configurable) · Notification bell with unread badge + dropdown · User avatar + name with dropdown (Dashboard, My Profile, Sign Out)
Logged outSign In link · Get Started button (links to register page)
ℹ️When the WordPress admin bar is active, the utility bar automatically offsets by 32px to sit below it. Background colour, text colour, and individual elements are all configurable in Settings.
19 · Email Templates

Email templates

Template keyWhen sent
welcomeOn new account creation
verify_emailOn registration — email verification link
password_resetOn forgot password request
admin_approvalWhen account approval is required
account_approvedWhen admin approves a pending account
social_connectedWhen user connects a social provider
new_device_loginOn login from unrecognized device
magic_linkOn magic link request
2fa_codeOn email 2FA code request

Template variables

VariableAll templates
{{user_name}}User's display name
{{user_email}}User's email address
{{site_name}}Blog name
{{site_url}}Home URL
{{year}}Current year

Template-specific extras: verify_email{{verify_link}} · password_reset{{reset_link}} · magic_link{{magic_link}} · 2fa_code{{code}} · social_connected{{provider}}

20 · Notifications

In-plugin notifications

Stored in or_notifications. The utility bar bell shows unread count and a dropdown of the 10 most recent notifications.

TypeTrigger
xp_earnedXP awarded to user
badge_earnedBadge awarded
new_followerSomeone followed the user
AJAX actionDescription
or_get_notificationsReturns recent 10 + unread count
or_read_notificationMarks a single notification as read
or_read_all_notifsMarks all notifications as read
21 · Social Features

Social features

Follow system

Users can follow/unfollow each other. Relationships stored in or_follows. Follow button appears on other users' profile pages. Following awards XP (follow_user action). Followed user receives a new_follower notification. Follower/following counts shown on profile stats bar.

Direct messaging

Basic user-to-user messaging via or_messages.

AJAX actionDescription
or_send_messageSend a message to another user
or_get_messagesLoad conversation thread between two users
or_get_inboxLoad all conversation threads for current user
22 · REST API

REST API endpoints

Base namespace: /wp-json/oengage/v1/

GET /profile/{user_id}

Returns a user's public profile data. Returns 403 if profile is private, 404 if user not found. Email is never returned for privacy.

JSON{
  "user_id":      42,
  "display_name": "Jane Doe",
  "bio":          "WordPress developer",
  "avatar_url":   "https://example.com/wp-content/uploads/avatar.jpg",
  "total_xp":     1500,
  "level":        5,
  "login_streak": 7,
  "privacy":      "public",
  "registered":   "2024-01-15 10:30:00",
  "last_active":  "2025-04-20 14:22:00"
}

GET /leaderboard

Returns top users by XP. Query params: ?type=xp · ?limit=1-50 (default 10).

JSON[
  {
    "rank":         1,
    "user_id":      42,
    "display_name": "Jane Doe",
    "avatar_url":   "...",
    "value":        12500,
    "level":        "Legend"
  }
]

GET /user/{user_id}/xp

Returns XP and level data for a user.

JSON{
  "level":          5,
  "level_name":     "Veteran",
  "total_xp":       1500,
  "next_threshold": 3000,
  "progress":       53
}
23 · Developer Hooks

Developer hooks

Action hooks

PHP// After user registers (before email verification)
do_action( 'oengage_user_registered', $user_id );

// After successful login
do_action( 'oengage_login', $user_id );

// When XP is awarded
do_action( 'oengage_xp_awarded', $user_id, $amount, $action );

// When a badge is earned
do_action( 'oengage_badge_earned', $user_id, $badge_id );

// When a user follows another
do_action( 'oengage_user_followed', $follower_id, $following_id );

// When a streak is updated
do_action( 'oengage_streak_updated', $user_id, $current_streak );

// When a direct message is sent
do_action( 'oengage_message_sent', $sender_id, $receiver_id );

// When a user's profile is updated
do_action( 'oengage_profile_updated', $user_id );

Usage examples

PHP// Slack notification on registration
add_action( 'oengage_user_registered', function( $user_id ) {
    $user = get_userdata( $user_id );
    // ... send Slack notification
} );

// Award XP on WooCommerce order completion
add_action( 'woocommerce_order_status_completed', function( $order_id ) {
    $order   = wc_get_order( $order_id );
    $user_id = $order->get_user_id();
    if ( $user_id ) {
        \OEngage\Gamification\XPEngine::award( $user_id, 100, 'woo_purchase' );
    }
} );

// Custom logic when a badge is earned
add_action( 'oengage_badge_earned', function( $user_id, $badge_id ) {
    // Webhook, push notification, etc.
}, 10, 2 );
24 · Helper Functions

Helper functions

Static methods available anywhere in your theme or plugin code.

PHP// XP
$xp = \OEngage\Gamification\XPEngine::get_total( $user_id );
\OEngage\Gamification\XPEngine::award( $user_id, 50, 'custom_action' );

// Badges
\OEngage\Gamification\BadgeEngine::award( $user_id, $badge_id );

// Level data
$level = \OEngage\Gamification\LevelEngine::get_user_level( $user_id );
// Returns: [ 'level', 'level_name', 'total_xp', 'next_threshold', 'progress' ]
$name = \OEngage\Gamification\LevelEngine::get_level_name( 5 );

// Streaks
$streak  = \OEngage\Gamification\StreakEngine::get_streak( $user_id );
$longest = \OEngage\Gamification\StreakEngine::get_longest_streak( $user_id );

// Leaderboard (cached, 5-min TTL)
$board = \OEngage\Gamification\Leaderboard::get( 'xp', 10 );

// Profile
$profile = \OEngage\Profile\ProfileRepository::get_user_profile( $user_id );
$avatar  = \OEngage\Profile\ProfileRepository::get_avatar_url( $user_id, 80 );
$pct     = \OEngage\Profile\ProfileRepository::get_completeness( $user_id );
$can_view = \OEngage\Profile\ProfileRepository::can_view_profile( $profile_uid, $viewer_id );

// Follow system
$following       = \OEngage\Social\FollowSystem::is_following( $follower_id, $following_id );
$follower_count  = \OEngage\Social\FollowSystem::get_follower_count( $user_id );
$following_count = \OEngage\Social\FollowSystem::get_following_count( $user_id );

// Notifications
\OEngage\Notifications\NotificationEngine::create( $user_id, 'custom_type', 'Your message.' );
$count = \OEngage\Notifications\NotificationEngine::get_unread_count( $user_id );

// Email
\OEngage\Notifications\EmailNotifier::send( $user_id, 'welcome', [] );
\OEngage\Notifications\EmailNotifier::send( $user_id, 'magic_link', [ 'magic_link' => $url ] );

// Sessions
\OEngage\Auth\SessionManager::create_session( $user_id );
\OEngage\Auth\SessionManager::revoke_all( $user_id );
$sessions = \OEngage\Auth\SessionManager::get_user_sessions( $user_id );
25 · Competitor Comparison

How OEngage stacks up

FeatureOEngageUltimate MemberProfilePressWP User ManagerMemberPress
Custom login/register pages
Social login (Google)ExtensionExtensionExtension
Social login (Apple)
Social login (GitHub)
Magic link login
Two-factor authExtension
Session management
XP / Points systemExtensionExtension
LevelsExtensionExtension
Login streaks
Badge systemExtensionExtension
LeaderboardExtensionExtension
Utility bar (XP on every page)
Activity tracking
Follow/unfollow
Direct messagingExtensionExtensionExtension
Email template editorExtension
REST API
Brute force protection
Price$79/yr$249/yr+$99–299/yr$149/yr$179–399/yr
26 · Pricing Model

Plans & pricing

Core
$0
free forever
  • Custom login and register pages
  • Email verification
  • Google social login
  • Basic user profile
  • Admin user list
  • Brute force protection
  • Password reset
Agency
$149/yr
up to 25 sites
  • All Pro features
  • WordPress Multisite support
  • White-label (remove Orravo branding)
  • Priority email support
27 · Changelog

What's shipped

v1.0.0 Initial release · 2025-04
  • Custom login, register, forgot-password, profile, dashboard pages
  • Social auth: Google, GitHub (Apple and LinkedIn configurable)
  • Magic link passwordless login (15-min expiry, single-use)
  • Two-factor authentication (TOTP RFC 6238 + email code)
  • Brute force protection with configurable limits
  • Session management with device tracking
  • Registration: reCAPTCHA v3 + hCaptcha, invitation codes, email domain whitelist, admin approval
  • Configurable registration field builder
  • XP engine with configurable actions and values
  • Level system with configurable thresholds (8 defaults)
  • Login streak tracking + longest streak record
  • Badge system: manual + automatic conditions (XP threshold, streak)
  • Leaderboard shortcode (5-min cached transient)
  • Persistent utility bar: XP, streak, notification bell, profile dropdown
  • In-plugin notification system (xp_earned, badge_earned, new_follower)
  • Email template editor with 9 templates and {{variable}} system
  • User profile with avatar upload, bio, privacy controls, completeness indicator
  • Follow/unfollow users
  • Direct messaging (basic)
  • REST API: /profile/{id}, /leaderboard, /user/{id}/xp
  • Admin: user list with stats, single user view, award XP/badge, impersonate
  • Full Orravo design system (dark/light, matches OMailer/OForum)
  • 10 custom DB tables, full uninstall cleanup
  • Developer action hooks and static helper methods
✦ Need help?

Got a question about OEngage?

Reach out directly — Kenneth replies within 24 hours.