Tomohiro Shiotani

<p>Content Bridge for Commerce provides a lightweight REST API endpoint that allows external commerce platforms such as Shopify to fetch WordPress editorial content.</p>
<p>This plugin does not sync databases or duplicate content. It simply exposes your WordPress posts through a clean, structured JSON API designed for external consumption.</p>
<h3>Key Features</h3>
<ul>
<li>Fetch latest WordPress posts via REST API</li>
<li>Filter posts by category or tag (using slug)</li>
<li>Return featured image, excerpt, and publish date</li>
<li>Optional conversion of Jetpack (i0.wp.com) CDN image URLs back to original URLs</li>
<li>Configurable default post count and limits</li>
<li>Built-in transient cache (5 minutes) to reduce database load</li>
<li>No data duplication or migration required</li>
</ul>
<h3>REST API Endpoint</h3>
<p>Base endpoint:</p>
<pre><code>/wp-json/content-bridge/v1/posts
</code></pre>
<p>Examples:</p>
<p>Latest posts:<br />
    /wp-json/content-bridge/v1/posts?per_page=4</p>
<p>Posts filtered by tag:<br />
    /wp-json/content-bridge/v1/posts?tax=post_tag&term=guidi&per_page=4</p>
<p>Posts filtered by category:<br />
    /wp-json/content-bridge/v1/posts?tax=category&term=news&per_page=4</p>
<p>If no taxonomy is specified, the API returns the latest posts from all published posts.</p>
<h4>Authentication</h4>
<p>This plugin protects its REST API using a simple API key mechanism.</p>
<p>Requests must include a valid API key via the following HTTP header:</p>
<p>X-Content-Bridge-Key: YOUR_API_KEY</p>
<p>If the API key is missing or invalid, the endpoint will return a 401 Unauthorized response.</p>
<p>The API key can be configured in the plugin settings screen.</p>
<p>The API key can be manually set or generated from the plugin settings screen.</p>
<h3>Settings</h3>
<p>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Content Bridge for Commerce</p>
<ul>
<li>Default number of posts</li>
<li>Maximum allowed posts per request</li>
<li>Image size (thumbnail / medium / large / full)</li>
<li>Excerpt length (word count)</li>
<li>Enable or disable Jetpack CDN URL unwrapping</li>
</ul>
<h3>Privacy</h3>
<p>Content Bridge for Commerce does not collect, store, or transmit any personal data.</p>
<p>The plugin only exposes publicly available WordPress post data (such as title, excerpt, featured image, and permalink) via a REST API endpoint.</p>
<p>No data is sent to external servers by this plugin.</p>


Content Bridge for Commerce

Bridge WordPress editorial content to Shopify and other commerce platforms via a simple REST API.

Elementor

<p>Sticklight Connector provides a structured way to use the WordPress user system in external or React-based applications.</p>
<p>The plugin extends the WordPress REST API with additional endpoints that allow authenticated clients to retrieve user context and interact with WordPress data, while fully respecting core authentication methods, roles, and capability checks.</p>
<p>Sticklight does not replace WordPress authentication. It relies on <code>wp_authenticate</code> for credential validation and WordPress Application Passwords for API access, and follows standard permission checks (<code>current_user_can</code>) for all requests.</p>
<h4>Typical use cases</h4>
<ul>
<li>React applications connected to a WordPress site</li>
<li>Headless or hybrid WordPress setups</li>
<li>Admin or user dashboards built outside wp-admin</li>
<li>External tools that require authenticated access to WordPress data</li>
</ul>
<h4>Features</h4>
<ul>
<li>Authenticates via <code>wp_authenticate</code> and issues Application Passwords for API access</li>
<li>Adds REST endpoints for login, logout, and retrieving current user context</li>
<li>Enforces WordPress capability checks on all requests</li>
<li>Supports cross-origin headless setups</li>
<li>Extensible via WordPress hooks and filters</li>
</ul>
<h3>Usage</h3>
<h4>Login</h4>
<p>Authenticate with username (or email) and password:</p>
<pre><code>POST /wp-json/sticklight/v1/auth/login
</code></pre>
<p>On success the response includes an Application Password for subsequent API requests and the authenticated user:</p>
<pre><code>{
  "app_password": "XXXX XXXX XXXX XXXX XXXX XXXX",
  "user": {
    "user_id": 1,
    "username": "admin",
    "display_name": "Admin",
    "email": "admin@example.com",
    "roles": ["administrator"]
  }
}
</code></pre>
<p>Use the returned <code>app_password</code> with HTTP Basic Authentication for all further requests.</p>
<h4>Current user</h4>
<p>Retrieve the current authenticated user:</p>
<pre><code>GET /wp-json/sticklight/v1/auth/me
</code></pre>
<h4>Logout</h4>
<p>Revoke the current Application Password session:</p>
<pre><code>POST /wp-json/sticklight/v1/auth/logout
</code></pre>
<h4>User registration</h4>
<p>User creation is handled through the built-in WordPress REST API (<code>POST /wp-json/wp/v2/users</code>) and requires administrator authentication.</p>
<h4>Accessing protected data</h4>
<p>Requests to any endpoint must pass standard WordPress permission checks. Sticklight does not bypass or override these checks.</p>
<h3>Security</h3>
<p>Sticklight follows WordPress security practices:</p>
<ul>
<li>Authenticates via <code>wp_authenticate</code>, which respects all security plugin hooks (rate limiting, two-factor authentication, brute-force protection)</li>
<li>Issues Application Passwords scoped to individual sessions</li>
<li>Does not provide user registration — accounts must be created by an administrator</li>
<li>Applies capability checks (<code>current_user_can</code>) on all endpoints</li>
<li>Does not expose private data without proper permissions</li>
</ul>
<p>For external applications, it is recommended to:</p>
<ul>
<li>Use HTTPS</li>
<li>Restrict allowed origins</li>
<li>Avoid exposing sensitive endpoints unnecessarily</li>
</ul>


Sticklight

Use WordPress authentication and permissions in external React applications via secure REST API endpoints.

Content Bridge for Commerce vs Sticklight