DocCheck Access

描述

The DocCheck Access plugin integrates DocCheck’s OAuth2 authentication system into your WordPress site, allowing medical professionals to log in using their DocCheck credentials.

Note: Using DocCheck Access requires the Economy or Business license model. This plugin cannot be used with the Basic license model. Please contact DocCheck for details on available license models.

Features

• Adds a DocCheck login button via shortcode or automatic page-level protection
• OAuth 2.0 Authorization Code flow with PKCE for secure authentication
• Two authentication modes: Anonymous Session and WordPress User creation
• Per-page and global content protection with role-based access control
• Configurable scope and user metadata mapping
• Template override support for protected pages
• Hooks and filters for developers to customize behavior

External Services

This plugin connects to the following external services:

DocCheck OAuth Server (https://auth.doccheck.com)

Used to exchange the OAuth authorization code for an access token and to retrieve the authenticated user’s profile data. This connection is only made when a visitor actively clicks the DocCheck login button. Please refer to the DocCheck Privacy Policy and DocCheck Terms of Service.

DocCheck CDN (https://dccdn.de)

The DocCheck login button is a web component whose script is served from DocCheck’s CDN. It is loaded only on pages where the [docacc_login] shortcode or page-level protection is active — not on every page. Please refer to the DocCheck Privacy Policy.

No data is transmitted to any other third-party service.

Requirements

• WordPress 5.0 or higher
• PHP 7.2 or higher
• A DocCheck OAuth client ID and client secret (obtainable from DocCheck)

General Settings

Go to Settings > DocCheck Login in your WordPress admin to configure the plugin. You can also open the settings directly from the Settings link on the WordPress plugins overview screen.

OAuth Credentials

• Client ID — Your DocCheck OAuth Client ID.
• Client Secret — Your DocCheck OAuth Client Secret.
• Redirect URI — Auto-generated based on your site URL. Copy this value into your DocCheck application settings.

Redirection & Debug

• Default Target Page — The page users land on after a successful login.
• Debug Mode — Logs detailed API and authentication information. Disable on production sites.

Content Protection

Restrict Options before Login

• Use Custom Template — Default behavior. Replaces the protected page output with the protected-content template or your theme override.

• Redirect to Page Link — Sends unauthenticated visitors to a public page of your choice. After login, they are redirected back to the originally requested protected page.

• Make all Pages Private — Requires DocCheck login for every page on the site.

• Auto-assign Parent Configurations — Child pages automatically inherit their parent page’s protection status.
• Login Button Version — Pin a specific component version (e.g. 3.2.7) or use @latest to always load the most recent version.

User Management

Authentication Modes

• Anonymous Session — Users are authenticated via DocCheck but no WordPress user account is created. Data is held only for the duration of the PHP session and is not stored permanently.
• WordPress User — A WordPress user account is created or linked on the visitor’s first DocCheck login. Allows persistent storage of user properties and role-based access control.

Role & Metadata

• Default User Role — The WordPress role assigned to newly created DocCheck users. Only low-privilege roles (those without manage_options or edit_others_posts capabilities) are available for selection. Administrator and Editor roles cannot be assigned to DocCheck users.
• Automatic User Creation — Disabled by default. In WordPress User mode, local user creation for first-time DocCheck logins must be explicitly enabled by an administrator.
• Scope & Property Selection — Choose which DocCheck scopes to request and which user properties to store as WordPress user metadata.

Developer Hooks

Actions

• docacc_user_created — Fires after a new WordPress user is created via DocCheck login.
  Parameters: $user_id (int), $user_data (array)

• docacc_user_logged_in — Fires when an existing user logs in via DocCheck.
  Parameters: $user_id (int), $user_data (array)

• docacc_session_created — Fires when a user is authenticated in anonymous session mode.
  Parameters: $user_data (array)

Filters

• docacc_map_role — Customize role assignment based on DocCheck user data.
  Parameters: $current_role (string), $user_data (array), $user_id (int)
  Note: roles with manage_options or edit_others_posts capabilities are silently rejected for security reasons.

• docacc_protected_template — Override the template used for protected pages.
  Parameters: $template (string)

• docacc_is_authenticated — Override the authentication check result.
  Parameters: $authenticated (bool)

• docacc_user_data — Modify the DocCheck user data array before it is used.
  Parameters: $user_data (array)

Template Functions

// Check if the current visitor is authenticated via DocCheck
docacc_is_authenticated(); // returns bool

// Get the authenticated user's DocCheck profile fields
docacc_get_user_data(); // returns array, empty if not authenticated

Example in a theme template:

<?php if ( docacc_is_authenticated() ) : ?>
    <div class="hcp-content">Visible only to DocCheck users.</div>
<?php else : ?>
    <?php echo do_shortcode( '[docacc_login]' ); ?>
<?php endif; ?>

Custom Protected Page Template

The plugin provides a default template for pages that are DocCheck protected. You can customize this in two ways.

Theme Template File

Create doccheck-protected.php in your active theme root. The plugin will load it automatically instead of the built-in fallback template.

<?php
/**
 * Template used for DocCheck protected pages.
 *
 * Place this file in your active theme:
 * /wp-content/themes/your-theme/doccheck-protected.php
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

get_header();
?>

<main class="doccheck-protected-page">
    <section class="doccheck-protected-box">
        <h1><?php the_title(); ?></h1>
        <p>This content is protected. Please log in with your DocCheck account to continue.</p>

        <?php echo do_shortcode( '[docacc_login samepageredirect="1"]' ); ?>
    </section>
</main>

<?php get_footer(); ?>

WordPress Filter

Use the docacc_protected_template filter in your theme’s functions.php when you want to load a template from a custom location.

add_filter( 'docacc_protected_template', function( $template ) {
    $custom_template = get_stylesheet_directory() . '/templates/doccheck/custom-protected.php';

    if ( file_exists( $custom_template ) ) {
        return $custom_template;
    }

    return $template;
} );

How the template is used: the plugin loads this template only for singular protected content when the visitor is not authenticated. Your template runs as a normal WordPress theme template, so you can use functions like get_header(), get_footer(), the_title(), and do_shortcode(). In most cases, you should render the login button with [docacc_login samepageredirect="1"] so the user returns to the same protected page after login.

User Metadata Stored

In WordPress User mode, the following meta fields are stored per user (subject to selected scopes):

• docacc_unique_id — DocCheck unique identifier (always stored)
• docacc_profession — Profession name
• docacc_country — Country ISO code
• docacc_language — Interface language
• first_name, last_name — Name fields
• docacc_email — Email address
• docacc_discipline_name — Medical discipline
• docacc_activity_name — Activity type
• docacc_area_code, docacc_street, docacc_city, docacc_state — Address fields
• docacc_last_login — Timestamp of last DocCheck login