Connect

Connect WordPress.com

Call GET /v1/connect/wordpress with profileId and redirect_url, then send the site owner's browser to the returned authUrl:

curl "https://zernio.com/api/v1/connect/wordpress?profileId=66a1f0c2a4b9d3e8f1a2b3c4&redirect_url=https%3A%2F%2Fmyapp.com%2Fconnected" \
  -H "Authorization: Bearer $ZERNIO_API_KEY"

Response (200):

{
  "authUrl": "https://public-api.wordpress.com/oauth2/authorize?...",
  "state": "..."
}

Redirect the browser to authUrl. WordPress.com handles consent and site selection.

Its callback connects the selected site and sends the browser to your redirect_url.

The returned WordPress.com numeric site ID becomes that account's blogId. Read it through List blogs instead of constructing it.

redirect_url must be a safe absolute destination. Keep the returned state opaque; Zernio validates it at the callback.

Reconnecting the same profile to the same site refreshes the connection in place rather than creating another account slot.

WordPress.com OAuth scopes

Zernio uses WordPress.com's default single-site authorization by omitting the scope parameter.

The consent grants access to the selected site. Zernio uses that connection for articles, featured images and tags.

It does not request the explicit global scope that grants access across all your sites.

Granular scopes such as posts and media do not support the /wp/v2 API used by this integration.

See the official WordPress.com OAuth documentation for the upstream scope model.

Connect self-hosted WordPress

In WordPress admin, the site owner opens their user profile and creates an Application Password for Zernio.

Send the generated password with the login username to POST /v1/connect/wordpress/token:

curl -X POST "https://zernio.com/api/v1/connect/wordpress/token" \
  -H "Authorization: Bearer $ZERNIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "profileId": "66a1f0c2a4b9d3e8f1a2b3c4",
    "siteUrl": "https://example.com",
    "username": "editor@example.com",
    "applicationPassword": "xxxx xxxx xxxx xxxx xxxx xxxx"
  }'

Response (200):

{
  "account": {
    "_id": "66b2e19d8c3f5a7e9d0b1c2d",
    "platform": "wordpress",
    "username": "example.com",
    "displayName": "Example Press",
    "profileId": "66a1f0c2a4b9d3e8f1a2b3c4"
  }
}

siteUrl must use HTTPS and identify the public site root. Do not include /wp-json, a REST endpoint, a username, a password or other credentials in the URL.

Before persisting the account, Zernio:

1. safely discovers the site's REST API
2. rejects private or local network targets
3. verifies the credentials
4. checks publish/upload capabilities

An Application Password is separate from the user's interactive WordPress password. Treat it as a secret and revoke it from WordPress admin when it is no longer needed.

Revoking it immediately stops API access. Reconnect the account with a new Application Password to restore it.