Digitaldive

<p>WP OAuth2 adds “Login with WordPress.com” (OAuth2) to your WordPress login screen and a connect/disconnect widget on user profile pages. It’s designed for agencies and teams managing multiple sites who want a consistent WordPress.com login without installing Jetpack.</p>
<p>External Service: WordPress.com OAuth2 API<br />
– Service purpose: Authenticate users with their WordPress.com accounts.<br />
– Data sent: Client ID, redirect URI, OAuth authorization code, and standard HTTP request metadata during the OAuth flow.<br />
– Data received: WordPress.com user ID, email, and display name to link or create WordPress users.<br />
– Service terms: https://wordpress.com/tos/<br />
– Privacy policy: https://automattic.com/privacy/</p>
<p>Features:</p>
<ul>
<li>WordPress.com login (OAuth2 “auth” scope).</li>
<li>Link or unlink WordPress users to WordPress.com accounts.</li>
<li>Auto-create users when no matching email exists (optional).</li>
<li>Allowlist by email domain or WordPress.com user ID (optional).</li>
<li>Audit log of the last 20 OAuth attempts (optional).</li>
<li>Stores only WordPress.com user ID in user meta (no access tokens stored).</li>
<li>Short-lived OAuth state with HttpOnly cookie + transient for CSRF protection.</li>
</ul>
<p>Setup requires creating a WordPress.com application and adding the redirect URI shown in the plugin settings. Feature toggles let you enable or disable the login button, profile widget, auto-create users, admin notices, allowlists, and the audit log.</p>
<h3>Privacy</h3>
<p>This plugin connects to WordPress.com to authenticate users. It stores the WordPress.com user ID in WordPress user meta to link accounts. OAuth access tokens are used during the login flow and are not stored. A short-lived HttpOnly cookie and transient are used for OAuth state validation and expire automatically. If the audit log is enabled, the last 20 OAuth attempts are stored (time, status, IP address, and basic details) in a non-autoloaded option. WordPress.com service terms: https://wordpress.com/tos/ and privacy policy: https://automattic.com/privacy/.</p>


OAuth2 Account Login

Add WordPress.com OAuth2 login to WordPress. Let teams sign in with WordPress.com, link accounts, and avoid Jetpack. Not affiliated with Automattic.

jfwenisch

<p>Keystone OIDC transforms your WordPress installation into a fully-featured <strong>OpenID Connect (OIDC) identity provider</strong>, allowing other applications to authenticate users via your WordPress user database.</p>
<h4>Key Features</h4>
<ul>
<li><strong>OIDC Authorization Code Flow</strong> with PKCE support</li>
<li><strong>RS256 JWT</strong> signed access tokens and ID tokens</li>
<li><strong>Admin UI</strong> to create and manage multiple OIDC clients</li>
<li><strong>Client secret management</strong> – generate and reset secrets securely (shown only once)</li>
<li><strong>OIDC Discovery</strong> endpoint (<code>/wenisch-tech/keystone-oidc/.well-known/openid-configuration</code>) for automatic client configuration</li>
<li><strong>Standard scopes</strong>: <code>openid</code>, <code>profile</code>, <code>email</code></li>
<li><strong>Refresh tokens</strong> for long-lived sessions</li>
<li><strong>Zero additional configuration</strong> after install – just create a client and you’re ready</li>
</ul>
<h4>Quick Start</h4>
<ol>
<li>Install and activate the plugin</li>
<li>Go to <strong>OIDC Provider <span aria-hidden="true" class="wp-exclude-emoji">→</span> Add Client</strong> in your WordPress admin</li>
<li>Enter your application name and redirect URI(s)</li>
<li>Copy the generated <strong>Client ID</strong> and <strong>Client Secret</strong> (shown once)</li>
<li>Configure your OIDC client application with the discovery URL shown in the settings</li>
</ol>
<h4>Endpoints</h4>
<p>All URLs are relative to your WordPress site root.</p>
<ul>
<li><strong>Discovery:</strong> <code>/wenisch-tech/keystone-oidc/.well-known/openid-configuration</code></li>
<li><strong>Authorization:</strong> <code>/wenisch-tech/keystone-oidc/oauth/authorize</code></li>
<li><strong>Token:</strong> <code>/wenisch-tech/keystone-oidc/oauth/token</code></li>
<li><strong>UserInfo:</strong> <code>/wenisch-tech/keystone-oidc/oauth/userinfo</code></li>
<li><strong>JWKS:</strong> <code>/wenisch-tech/keystone-oidc/oauth/jwks</code></li>
</ul>
<p>Compatibility aliases are also routed under <code>/wenisch-tech/keystone-oidc/protocol/openid-connect/*</code> for clients that still derive Keycloak-style paths from the custom issuer URI. These aliases are not advertised in discovery.</p>
<h4>UserInfo Example</h4>
<p>For <code>openid profile email</code>, <code>/wenisch-tech/keystone-oidc/oauth/userinfo</code> returns:</p>
<pre><code>{
  "sub": "42",
  "name": "Jane Doe",
  "given_name": "Jane",
  "family_name": "Doe",
  "preferred_username": "jane",
  "email": "jane@example.com",
  "email_verified": true
}

sub is the WordPress user ID as a string, `preferred_username` is the WordPress `user_login`, and `email` is the WordPress `user_email`.
</code></pre>
<p>Roles are not currently emitted. The plugin does not expose WordPress roles or capabilities in UserInfo or ID tokens.</p>
<h3>[2.3.0](https://github.com/wenisch-tech/wordpress-keystone-oidc/compare/v2.2.2…v2.3.0) (2026-06-14)</h3>
<h3>Features</h3>
<ul>
<li>consent-screen now uses theme default colors if available (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/24beefead5ac2fab30e0945c58af3f009a733c1c" rel="nofollow ugc">24beefe</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>ensure compability with wordpress v7 (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/36f0d5040ee72d8f2ad9b76ff07da25ed5649bce" rel="nofollow ugc">36f0d50</a>)</li>
</ul>
<h4>2.2.2</h4>
<p>Released on 2026-06-12.</p>
<h4>Bug Fixes</h4>
<ul>
<li>updated release versioning and changelog creation (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/98cfb3062232f96346646f915a90198f69b17f51" rel="nofollow ugc">98cfb30</a>)</li>
<li>updated repository links (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/f46b2b6f2012cd348eab5e73f5ca9410f0efc406" rel="nofollow ugc">f46b2b6</a>)</li>
<li>updatet generation of changelog. (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/357bded5f6cd824859dfc4710d72bdbec60da983" rel="nofollow ugc">357bded</a>)</li>
</ul>
<h4>Documentation</h4>
<ul>
<li>added “Report a bug” button to plugin page (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/8281f6c5cfd9474e785c06eaf562e1a2cb84f47d" rel="nofollow ugc">8281f6c</a>)</li>
</ul>
<h4>1.0.0</h4>
<ul>
<li>Initial release</li>
<li>Authorization Code Flow with PKCE</li>
<li>RS256 JWT tokens</li>
<li>Multi-client admin UI with secret management</li>
<li>OIDC Discovery endpoint</li>
<li>Refresh token support</li>
</ul>


Keystone OIDC

Turn your WordPress site into an OpenID Connect (OIDC) identity provider. Manage clients through a simple admin panel.

OAuth2 Account Login vs Keystone OIDC