PD Support PIN for Blesta

PD Support PIN gives every client a short personal PIN they can read in their client area and quote when they contact you, so your team can check that the caller really is the account holder before touching their services. Staff type what the caller says and get a match or no-match answer, without ever having to see the stored PIN. It is free, with every feature included.

It is built for hosts whose support team takes phone calls and chat, and who need a quick, consistent way to stop social-engineering attempts such as a stranger asking for a password reset or a domain transfer.

Why hosts choose PD Support PIN

A real check, not a guess. The caller reads out a PIN, staff enter it, and the answer is a match or no match for that client. A PIN only verifies for the client it belongs to, and a wrong or empty PIN never matches.

Staff do not need to see the PIN. The check is blind: the Verify tab confirms a match without displaying the stored PIN, on success or failure. You can give caller checks to staff who should not be able to read a customer's PIN at all.

Every check is on the record. Every verification, match or not, is logged with the client, the time and who checked. Reveals and regenerations are logged too, and the audit log is kept for a year.

PINs you can trust. They are generated from a secure random source, never stored empty if generation fails, and are 6 to 8 characters long, numbers only by default or letters and numbers with look-alike characters left out.

Catches guessing. After several wrong PINs for the same client in a short window, the API answers with a rate limit, and the assistant tool is limited the same way. The report counts matches and no-match attempts over 30 days.

No cost, no catch. PD Support PIN is free with every feature included: no paid tier, no add-on and nothing that switches off when a licence lapses. It calls no paid third-party service.

How it works

1. Install PD Support PIN from PD Modules. Nothing to configure to start; defaults are sensible.
2. PINs appear on their own. A client gets a PIN the first time they open their dashboard, or the first time staff open their Summary page. No bulk set-up is needed.
3. A caller gives their PIN. Staff enter it in the Verify tab, or check it from the client's profile.
4. You get a clear answer. "Verified, the PIN matches" or "No match", logged in Activity.

What you get in Blesta

Checking a caller

• A Verify tab with a client picker and a PIN box. It refuses to run without both
• Staff can check a PIN from the client's profile
• Blind checking makes it safe to give caller checks to staff who should not be able to read a customer's PIN at all
• Alphanumeric PINs verify as staff type what they heard, letters in either case

PIN rules you control

• Length from 6 to 8, numbers-only or alphanumeric. A new length or alphabet applies to new and regenerated PINs; existing PINs keep theirs until regenerated
• By default a PIN never changes on its own. Turn on "Regenerate the PIN after a successful verification" and a successful check rolls the PIN at once, so the same PIN cannot verify twice
• Or auto-rotate every client's PIN once it is a set number of days old, on cron, with each rotation logged
• "Hide the PIN until clicked" is on by default, so a PIN is not left on screen unless someone clicks to reveal it
• Regenerate after a confirmation; the old PIN stops working immediately

Reports and records

• Client PINs lists every client who has a PIN, with last-changed date, search by name or id, sorting, Reveal, Regenerate and Open client
• Activity lists every generation, regeneration, verification, rotation and reveal with client, time and who did it, filterable by event
• The report shows how many active clients have a PIN, callers matched, no-match attempts in 30 days and the last check

Verification API

• Check a PIN from your own phone system, helpdesk or tools. Off by default; when on, it answers match true or false and never returns a PIN
• The key is shown once when generated, stored only as a hash, and regenerating it stops the old key at once. A key in the URL is refused
• Identify the client by client id or by exact email. After 5 wrong PINs for a client in 15 minutes the API answers 429 for that client
• With PD MCP Hub, an assistant can ask whether a PIN matches and get only yes or no, and a status tool says whether a client has a PIN and how many failed checks it had in 24 hours, without revealing it

What your customers get

• A Support PIN panel on their client-area dashboard with a one-line explanation, on by default and removable
• A Generate a new PIN button, if you allow it, so a client who thinks someone else has seen their PIN can roll it themselves. It is shown at once and the old one stops working. Only the signed-in client, from their own dashboard, can do it
• Every line can be translated or reworded in an override folder that updates never overwrite
• On Blesta there is no sidebar card or Account-menu row, and the PIN is not shown on the admin ticket view; it is on the client profile

Security built in

• The stored PIN is never shown during a check, and the API and assistant tools can only answer match or no match.
• Every reveal by staff is recorded as "Revealed by staff", with who looked.
• Verification is exact-email and per-client, so one client's valid PIN never verifies another.
• PD Support PIN adds its own tables and templates and modifies no Blesta files. If anything goes wrong, it fails quietly rather than breaking the client area, the admin pages or cron.

Free, complete, clean

PD Support PIN is one free module with everything included. Uninstalling removes all PIN data, the activity log and the module's settings, and a reinstall starts fresh.

Requirements

• Blesta 6 or later on PHP 8.2 or later, with the ionCube Loader
• PD Modules, the free control panel every PD module installs into