uukidev

YUI Preview Token solves the authentication problem in decoupled (headless) WordPress architectures. Application Passwords are a great built-in WordPress feature for this purpose, but they require managing long-lived secrets on the frontend side. This plugin instead issues per-post tokens that grant read access for a configurable period — no persistent secrets required.
The frontend (Astro, Next.js, Nuxt, etc.) receives a preview URL and can fetch the draft content directly via the REST API.
<h4>How it works</h4>
<ol>
<li>An authorized WordPress user generates a token from the Gutenberg sidebar, Quick Edit panel, or Classic Editor meta box.</li>
<li>The token is embedded in a preview URL pointing to your external frontend.</li>
<li>The frontend calls <code>/wp-json/yui-preview-token/v1/preview?token=…</code> to retrieve the draft content.</li>
<li>The token expires automatically; no manual cleanup needed.</li>
</ol>
<h4>Key Features</h4>
Token Management
<ul>
<li>Generate tokens with expiry presets: 1 hour, 24 hours, 30 days, custom date/time, or no expiry.</li>
<li>One token per post — issuing a new token invalidates the previous one.</li>
<li>Tokens are generated with <code>bin2hex(random_bytes(32))</code> (256-bit CSPRNG). The lookup key stored in <code>wp_options</code> is the SHA-256 hash of the raw token, not the token itself — so a database leak does not expose usable tokens directly.</li>
<li>Automatic cleanup of expired tokens via WP Cron (daily).</li>
</ul>
Editor Integration
<ul>
<li>Gutenberg: dedicated panel in the Document Settings sidebar.</li>
<li>Quick Edit: token controls directly in the post list.</li>
<li>Classic Editor: meta box in the editor sidebar.</li>
<li>Copy preview URL to clipboard with one click.</li>
<li>Update expiry without invalidating the current token.</li>
</ul>
Admin Settings
<ul>
<li>Set the external frontend URL (clicking “Open external preview” navigates directly to this URL).</li>
<li>Configure allowed CORS origins (multiple, with wildcard support — <code>https://*.example.com</code>).</li>
<li>Choose the minimum WordPress role required to issue tokens (Subscriber → Administrator).</li>
<li>Tune rate limiting (requests per time window).</li>
<li>Optionally permit no-expiry tokens.</li>
</ul>
Issued Tokens List
<ul>
<li>View all active and expired tokens with post title, status, expiry, and issuer.</li>
<li>Revoke individual tokens or bulk-delete expired ones — all from the Settings screen.</li>
</ul>
Security
<ul>
<li>HTTPS required for the preview endpoint (overridable for local development).</li>
<li>Per-IP rate limiting with configurable thresholds (default: 30 req / 60 s).</li>
<li>Role-based access control for token issuance.</li>
<li>CORS headers only sent for explicitly configured origins; WP core’s permissive echo-back is suppressed.</li>
<li><code>Referrer-Policy: no-referrer</code> prevents token leakage via referer headers.</li>
<li>Tokens are only valid for <code>draft</code>, <code>pending</code>, and <code>future</code> post statuses.</li>
<li>Admin-only settings page with defence-in-depth capability checks.</li>
<li>CSRF protection on all admin actions (nonce verification).</li>
</ul>
Audit Logging
<ul>
<li>Logs token issuance and usage events (post ID, user ID, client IP).</li>
<li>Logs security events: invalid token attempts, rate-limit violations, capability denials.</li>
<li>Output goes to <code>WP_DEBUG_LOG</code> by default; point to a dedicated file with <code>PVT_LOG_FILE</code>.</li>
</ul>
Internationalisation
<ul>
<li>Ships with Japanese (ja) and Simplified Chinese (zh_CN) translations.</li>
<li>All admin UI strings are translation-ready.</li>
</ul>
<h4>Developer Hooks</h4>
Filter
<ul>
<li><code>yuipt_preview_response_data</code> — Modify the REST API response data before it is sent.</li>
</ul>
Actions
<ul>
<li><code>yuipt_token_issued( int $post_id, int $user_id )</code> — Fires after a token is issued.</li>
<li><code>yuipt_token_used( int $post_id, int $user_id )</code> — Fires when a token is used successfully.</li>
<li><code>yuipt_invalid_token( string $ip )</code> — Fires on an invalid/expired token attempt.</li>
<li><code>yuipt_rate_limit_exceeded( string $ip, string $endpoint )</code> — Fires when rate limit is hit.</li>
<li><code>yuipt_capability_denied( int $user_id, int $post_id )</code> — Fires on a capability denial.</li>
</ul>
Constants (wp-config.php)
<ul>
<li><code>PVT_SKIP_HTTPS_CHECK</code> — Set to <code>true</code> to disable the HTTPS requirement (development only).</li>
<li><code>PVT_LOG_FILE</code> — Absolute path to a dedicated audit log file.</li>
</ul>
<h4>Use Case</h4>
This plugin is designed for headless WordPress setups where a decoupled frontend (e.g. Astro, Next.js, Nuxt, SvelteKit) renders content from the WordPress REST API. It gives content editors a simple, secure way to share draft previews with stakeholders without granting them WordPress accounts or exposing long-lived API credentials.

YUI Preview Token

Issue time-limited preview tokens for headless WordPress setups. Open drafts directly in your frontend URL without long-lived credentials.

pl8apptoken

pl8app

This is a simple WP plugin developed by ourselves using API from Coingecko and PancakeSwap. Any pricing differences will be based on the exchanges used as we take our price only from PancakeSwap, however this should provide a relatively accurate price for coins which are not listed on the regular exchanges. We do however make the assumption you will need to have set up a liquidity pair within PancakeSwap (this allows any Swap/Token Trade to happen)
This will allow your customers to pay with any BEP20 token of your chosing.
We provide this plugin for free under the following licenses
“GPLv2 or later.”
The front end will provide the BEP20 Token Cryptocurrency as a payment option within the checkout area of Woocommerce. This will allow the user to select the token(s) you have added to the backend with pl8app token being as standard default.
Upon Checkout, when set up, the plugin will add BEP20 Cryptocurrency Token as a Payment Gateway Option, this will form a drop down box with all tokens added for your customer to select from.
Once the customer has selected their chosen token to pay with, they will then press place order.The next screen will show the relative number of token/coins to the currency amount of the product. Copy buttons included at Wallet and Number of Tokens for copying to customers wallet for transaction.
There is a Pay With MetaMask Button for your customers ease of use to connect with their Google browser based extension wallet.
The backend within WP admin has 3 sections;
<ol>
<li>All Crypto Currencies (this section displays any of the custom BEP20 tokens you have added)</li>
<li>Add New ( this section allows the admin user to add any BEP20 token, based on contract address, you will also need to add the tokens logo as a graphic file at this location). 
2.1 There is also a Tolerance (default at 2%) which is used as part of the automatic payment confirmation feature, where you will use this in relation to the total % fees your custom BEP20 token may have. For example if your custom BEP20 token has fees of 10%, you would change this tolerance to reflect this.</li>
<li>Crypto Payments Setting – This section has three main areas to cover; 
3.1. The first is a % markup/markdown, this is purely for use of your chosing, it is not required. 
3.2. The second section is mandatory for the plugin to operate correctly, this is the wallet addresses (Binance Smart Chain) for payments to be made to, multiple addresses can be used, the plugin should rotate between any of the addresses selected). You can easily check the payment has been made by checking your wallets either with Binance Smart Chain Wallet/MetaMask Wallet/Trust Wallet. Only dispatch the sold item once you have checked payment has been sent. 
3.3. The third is a quick checkbox for any cryptocurrencies you have added within 2. to be added as a payment selection. pl8app token is added by default for this plugin to work.</li>
</ol>
<h4>WooCommerce compatibility</h4>
This plugin is fully compatible with WooCommerce.
<h3>Privacy Policy</h3>
https://token.pl8app.co.uk/privacy-policy/
<h4>Contact us</h4>
Got questions or feedback? Let us know! Head to our website https://token.pl8app.co.uk and we have many methods of contact and further information on our project.
We are also available for support on https://t.me/pl8apptoken
<h4>About pl8app</h4>
We at pl8app have been developing various solutions since 2013, first being a simple Android based food review 
application. Essentially an app to take photos (and review) your plate, hence the name pl8app.
We have then developed ordering and time slot booking systems and solutions for the UK based Hospitality and Takwaway markets , more information can be seen at https://pl8app.co.uk (please note, we only sell to the UK due to our business policies, we actively Geofence this website from any other country to avoid any sign ups from Geographical areas we do not cater for.
Looking into the future, we developed our own BEP20 based token ( Contract Address 0xb77178a0fdead814296eae631be8e8171c02592b ) , this developed from the idea that many popular payment solutions these days can prove expensive, so we made a viable token with only 2% fees (1% of which is reflected back to our holders) to give the businesses we support by our solutions a fair alternative, with low fees and payments straight to their wallet (some providers and solutions also can hold funds for a number of days).
Whereas our main goal was to integrate the cryptocurrency payments into our own solutions as standard we needed to first build up a range of tools to allow us to do so, the first was simple to get the price of any BEP20 token which has not been listed on any exchanges. There are many of these, so we saw it as a common issue.
The second goal, relied on the first to get the price, which could then work along side regular FIAT currencies to make the gateway work, with a payment confirmation built in ofcourse.
After creating these tools for ourselves, we decided to release edited versions as WordPress Plugins for our greater community.
We will always be developing new solutions based on our needs, or the needs of our clients.

pl8app Cryptocurrency BEP20 Payment Gateway For WooCommerce

Take BEP20 Cryptocurrency on your Woocommerce based site, with the pl8app Token in built as standard, you can add any token of your chosing within the …

YUI Preview Token vs pl8app Cryptocurrency BEP20 Payment Gateway For WooCommerce