SimplyMade Connector

SimplyMade Connector lets a site administrator authorize a read-only site identity check for a client workspace in SimplyMade Social. A SimplyMade website plan and client portal account are required for the hosted service. The plugin does not publish, edit, delete, track visitors, add users, or create WordPress Application Passwords. Installing or activating it makes no outbound request. The administrator explicitly clicks Connect to begin pairing. The WordPress REST route /wp-json/simplymade/v1/connection returns the site address, blog ID, authorizing user ID, grant ID, HTTPS status, and read-only scope to a caller presenting the plugin's scoped token. The token does not authorize WordPress core post, page, theme, or plugin APIs. Publishing would require a separate, explicit future authorization and is not part of this read-only pairing. External service: when the administrator clicks Connect to SimplyMade, the plugin sends a short-lived, one-use code, canonical HTTPS site address, random grant ID and freshly generated scoped token to https://portal.simplymadesocial.com/v1/wordpress/plugin-pair over verified HTTPS. SimplyMade checks the code against the portal requester, workspace and site, then stores the token encrypted. SimplyMade later sends the token only in a read-only HTTPS connection-check request to this site's route. The site stores a SHA-256 token digest, grant ID, authorizing user ID and state in a non-autoload WordPress option; it does not store the token in plaintext. The service stores connection identity, state, and verification results. No data is sent before the administrator clicks Connect, and there is no visitor tracking or telemetry from this plugin. See the SimplyMade privacy policy and terms.

1. Install and activate SimplyMade Connector on the intended HTTPS WordPress site. Its public home address must be a root HTTPS origin with the standard /wp-json/ REST route; WordPress core may itself live in a subdirectory.
2. In the SimplyMade client portal, request that exact site's main HTTPS URL.
3. In the portal, explicitly authorize pairing and copy the ten-minute code.
4. As a WordPress administrator, open Settings > SimplyMade Connector, enter the code, and click Connect to SimplyMade.
5. Return to the portal. Pairing receipt is not a verified connection; SimplyMade must complete a separate read-only site check.

Only enter a code for a site and workspace that you are authorized to connect. The code and token are sent in the HTTPS request body, never in a URL.

0.2.0

• Add explicit one-use, read-only plugin pairing and local revocation.
• Keep a legacy Application Password connection check for existing assisted pilots.