Moksa for LINE

Description

Connects a WordPress site to the LINE platform.

• LINE Login — OAuth 2.0 and OpenID Connect with PKCE. Identity comes from a verified ID token, not an unauthenticated profile read. Visitors can register automatically or link LINE to an existing account from their profile.
• Bot — keyword rules matched by exact text, prefix, substring, regular expression or catch-all, ranked by match strength and priority. Replies can be text, a Flex template, a quick reply set, a sticker, an image or raw message JSON.
• Conversation flows — multi-step scenarios that collect answers for bookings, enquiries or sign-ups, with per-step validation, choices as quick reply buttons, a cancel path, stored submissions and optional email notification.
• AI replies — answers whatever the rules did not, using the AI Engine plugin’s chatbot and its knowledge base. Protected by a daily cap, a length limit and a hand-off keyword that passes the conversation to a person.
• Customer-service inbox — conversations captured from the webhook, with unread counts, bot/human/closed status, and replies sent from wp-admin.
• Rich menus — including tabbed menus, built from rich menu aliases so tabs switch instantly inside LINE.
• Flex messages — an editor with live preview, structural validation, LINE’s own validation endpoint and a test send.
• LINE Pay — a WooCommerce gateway with full and partial refunds, plus standalone payment links you can send straight into a chat.
• LIFF — profile and chat pages that run inside LINE, with every request’s ID token verified against LINE before it is trusted.
• Broadcast — to every follower or to the friends this site has recorded, with a typed confirmation and the remaining monthly quota shown.

Two things to know first

The Messaging API provides no way to read past conversations, so the inbox starts from the moment the webhook is switched on. And answering an inbound message within a minute is free, while anything sent afterwards — inbox replies, broadcasts, receipts — is a push message and is billed by LINE.

Privacy

The plugin stores LINE user ids, display names, profile picture URLs and, where the channel is approved for it, email addresses. Messages exchanged with the bot are stored so the inbox can show them, and are deleted after the retention period set in the settings. Credentials are encrypted at rest using keys derived from the site’s WordPress salts.

The conversation id given to an AI provider is a salted hash of the LINE user id, so the provider can keep context per person without ever receiving the LINE user id itself.

External services

This plugin connects your site to the LINE platform, which is operated by LY Corporation. It cannot work without doing so. Each service below is listed with what is sent, and when.

LINE Messaging API — api.line.me and api-data.line.me
Used to send and receive messages, issue channel access tokens, read the profile of someone who messages your bot, and create rich menus. Sent: your channel id and secret (to obtain a token), the LINE user id of the recipient, and the message content you or the bot compose. Called whenever a message is sent, a webhook event is processed, or a rich menu is published.

LINE Login — access.line.me and api.line.me
Used to sign visitors in and to verify the resulting ID token. Sent: your channel id and secret, and the authorization code returned by LINE. Received: the visitor’s LINE user id, display name, profile picture URL, and email address when your channel is approved for it. Called when a visitor uses a LINE login button.

LIFF SDK — static.line-scdn.net, and api.line.me for verification
A JavaScript file loaded in the visitor’s browser on pages using the LIFF shortcodes. It must be served from LINE’s own CDN; a bundled copy is not supported. Loaded only on pages containing [mofoline_liff_profile] or [mofoline_chat]. When the visitor opens such a page inside LINE, the ID token LIFF issues is sent from your site to api.line.me to be verified before the visitor’s LINE user id, display name and picture are used.

Images served by LINE — profile.line-scdn.net, stickershop.line-scdn.net
Profile pictures and sticker images are not copied to your site; they are loaded by the browser directly from LINE’s CDN wherever they are shown — the inbox and user list in wp-admin, and the visitor’s own picture on the My Account page and the LIFF profile. A browser loading them discloses its IP address and user agent to LINE, as with any image hosted elsewhere. Sent by the plugin: nothing; the URLs come from LINE’s own profile data.

LINE Pay — api-pay.line.me, or sandbox-api-pay.line.me in sandbox mode
Only contacted when LINE Pay is enabled. Sent: your LINE Pay channel id, a signature derived from your channel secret, the order reference, the amount and currency, and the names and quantities of the items being purchased. Called when a payment is reserved, confirmed, refunded, voided or queried.

Terms of use: https://terms.line.me/LINE_Developers_Agreement — Privacy policy: https://line.me/en/terms/policy/

Optional, off unless you configure it:

Webhook forwarding — if you set a forwarding URL in the settings, every webhook delivery from LINE is relayed to that URL unchanged, including the message content and the sender’s LINE user id. The destination is entirely your choice; nothing is sent anywhere until you enter one. The relay uses WordPress’s safe HTTP request, which refuses private and loopback addresses; a receiver on your own network (an n8n on the same machine, say) needs its host allowed through the core http_request_host_is_external filter.

AI replies — if you enable AI replies, the visitor’s message text and a pseudonymous conversation id are passed to the AI Engine plugin, which sends them onward to whichever AI provider you have configured in that plugin. This plugin does not contact any AI provider directly. Review AI Engine’s own disclosures for where that data goes.

This plugin is not affiliated with, endorsed by, or sponsored by LY Corporation.
LINE and the LINE logo are trademarks of LY Corporation. The plugin integrates
with LINE’s published APIs; you supply your own channel credentials.

Technical details