Phone + OTP sign-in powered by WhatsApp
How to create your Roznamcha Digital account with a phone number and a WhatsApp code — and how the security underneath actually works.
Email addresses are where verification codes go to die. Our users run shops, not inboxes — but nearly every one of them keeps WhatsApp open all day. So we made the phone number the identity and WhatsApp the channel. Here is how to use it, and what happens under the hood.
Creating your account
When you first launch Roznamcha Digital, the app asks you to sign in before creating your first company book:
- 1. Enter your Pakistani mobile number — 03XXXXXXXXX or +923XXXXXXXXX, both work.
- 2. A one-time code arrives on WhatsApp within seconds. Enter it in the app.
- 3. You are in. Set a password now or later — it is optional, and used for offline-friendly sign-in on new devices.
No email address, no inbox, no typing a 6-character code from a Gmail notification into a desktop app.
Password reset without the maze
Forget your password? The reset flow is the same channel: request a reset, get the code on WhatsApp, set a new password. Because the phone number is the identity, there is no recovery email to lose access to and no support ticket to file. Password resets went from our biggest support burden to almost nonexistent.
What is stored, and where
Your credentials never sit in a plain file. Sign-in tokens are encrypted on your PC using the operating system's secure storage (Electron safeStorage). A few more details worth knowing:
- Short-lived codes: OTPs expire quickly and are single-use — a code from last Tuesday is worthless today.
- Rate-limited delivery: attempts are capped per number, so nobody can spam codes at your customers or brute-force yours.
- No email on record: the account is keyed to your phone number; the app never displays any email address.
- 3-day offline grace: after signing in once, the app trusts your device for up to three days of no internet — a bad connection week does not lock you out of your own books.
Why channel choice matters
Authentication friction compounds: every extra step between download and first invoice loses users. Under the hood the cloud API runs Better Auth with a custom OTP plugin backed by Cloudflare Workers — but the technology is the boring part. The insight is simpler: meet people on the platform they already use.
Sometimes the best UX innovation is delivering the code where the user already is.