Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3777585,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3777585,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3777585,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3777585,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Settings \u2192 Keypaw: generate a token, choose the mapped user, revoke in one click.","2":"A freshly generated token with its copy-paste agent setup snippet (shown once).","3":"The public agent discovery manifest, as seen by an agent connecting for the first time."}},"plugin_section":[],"plugin_tags":[2353,1556,710,23853,333],"plugin_category":[38],"plugin_contributors":[289982],"plugin_business_model":[],"class_list":["post-392014","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-api","plugin_tags-authentication","plugin_tags-rest-api","plugin_tags-token","plugin_category-authentication","plugin_contributors-marsdream","plugin_committers-marsdream"],"banners":{"banner":"https:\/\/ps.w.org\/keypaw\/assets\/banner-772x250.png?rev=3777585","banner_2x":"https:\/\/ps.w.org\/keypaw\/assets\/banner-1544x500.png?rev=3777585","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/keypaw\/assets\/icon-128x128.png?rev=3777585","icon_2x":"https:\/\/ps.w.org\/keypaw\/assets\/icon-256x256.png?rev=3777585","generated":false},"screenshots":[],"raw_content":"\n
Your AI assistant needs to work in WordPress: draft posts, review content, update pages. To do that through the REST API, it needs credentials.<\/p>\n\n
The built-in option, Application Passwords, was designed for humans pasting a username and password pair into an app once. AI agents don't work that way:<\/p>\n\n
Keypaw takes a different approach: one token, built for agents.<\/strong><\/p>\n\n Security by design: HTTPS only, hashed storage, constant-time comparison, no telemetry, no external calls, and nothing is authenticated when no token is configured. The plugin adds no public write endpoints of its own \u2014 it only authenticates standard REST API requests as the user you mapped.<\/p>\n\n Born in production: Keypaw was written because an AI assistant reviewing drafts on a real site could not use Application Passwords at all. It has run that workflow daily since.<\/p>\n\n Note: if your tooling can use Application Passwords (local scripts, your own server code), they remain a fine built-in option. Keypaw exists for the growing number of agent platforms that cannot.<\/p>\n\n\n The token is a 48-character random string (about 285 bits of entropy). Only its SHA-256 hash is stored in your database, comparison is constant-time, and tokens are only honoured over HTTPS. A database leak does not leak usable tokens. Revocation is instant and per-token.<\/p><\/dd>\n Application Passwords are a username + password pair authenticated via Basic Auth. Keypaw is a single secret sent as a header, designed to fit agent platforms' single-key credential stores and to avoid hosts that block Basic Auth. See the Description for the full comparison.<\/p><\/dd>\n A saved login serves a browser clicking through wp-admin like a human \u2014 it has to pass the full login flow (including two-factor prompts) every session, and it cannot feed anything else. API connectors, cron jobs, and other headless tools never see a browser; what they can store is a single API secret. A token authenticates REST API calls directly, at any hour, with no login ceremony \u2014 and unlike your password, it cannot be used to sign in to wp-admin at all. Use saved logins for clicking; use a token for unattended API work.<\/p><\/dd>\n Any agent or tool that can call the REST API with a custom header: Muse custom connectors, MCP-based tools, local automation scripts, and similar. The public manifest endpoint lets conforming agents discover the connection details automatically.<\/p><\/dd>\n Exactly what the mapped WordPress user can do, via the standard REST API. Map the token to a low-privilege dedicated account to keep the blast radius small. The plugin itself grants no extra permissions.<\/p><\/dd>\n All tokens stop working immediately. Uninstalling removes the plugin's settings from the database.<\/p><\/dd>\n Not yet. Version 1.0 targets single-site installs.<\/p><\/dd>\n No. There are no external requests, no analytics, and no telemetry of any kind.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
X-Agent-Token<\/code>) over HTTPS. No Basic Auth, no username, nothing else to configure.<\/li>\n\/wp-json\/keypaw\/v1\/manifest<\/code>) describing how to connect \u2014 header name, site URL, and the mapped account's capabilities. Point your agent at your site and it can figure out the rest.<\/li>\n\n
keypaw<\/code> folder to \/wp-content\/plugins\/<\/code>, or install it via the WordPress plugins screen.<\/li>\n\n
Is this secure?<\/h3><\/dt>\n
How is this different from Application Passwords?<\/h3><\/dt>\n
Can't my agent just log in with my username and password?<\/h3><\/dt>\n
Which agents does it work with?<\/h3><\/dt>\n
What can an agent do with a token?<\/h3><\/dt>\n
What happens if I deactivate or uninstall the plugin?<\/h3><\/dt>\n
Does it work on multisite?<\/h3><\/dt>\n
Does the plugin phone home or collect data?<\/h3><\/dt>\n
1.0.0<\/h4>\n\n
\n