uukidev

<p><strong>YUI Preview Token</strong> solves the authentication problem in decoupled (headless) WordPress architectures. Application Passwords are a great built-in WordPress feature for this purpose, but they require managing long-lived secrets on the frontend side. This plugin instead issues per-post tokens that grant read access for a configurable period — no persistent secrets required.</p>
<p>The frontend (Astro, Next.js, Nuxt, etc.) receives a preview URL and can fetch the draft content directly via the REST API.</p>
<h4>How it works</h4>
<ol>
<li>An authorized WordPress user generates a token from the Gutenberg sidebar, Quick Edit panel, or Classic Editor meta box.</li>
<li>The token is embedded in a preview URL pointing to your external frontend.</li>
<li>The frontend calls <code>/wp-json/yui-preview-token/v1/preview?token=…</code> to retrieve the draft content.</li>
<li>The token expires automatically; no manual cleanup needed.</li>
</ol>
<h4>Key Features</h4>
<p><strong>Token Management</strong></p>
<ul>
<li>Generate tokens with expiry presets: 1 hour, 24 hours, 30 days, custom date/time, or no expiry.</li>
<li>One token per post — issuing a new token invalidates the previous one.</li>
<li>Tokens are generated with <code>bin2hex(random_bytes(32))</code> (256-bit CSPRNG). The lookup key stored in <code>wp_options</code> is the SHA-256 hash of the raw token, not the token itself — so a database leak does not expose usable tokens directly.</li>
<li>Automatic cleanup of expired tokens via WP Cron (daily).</li>
</ul>
<p><strong>Editor Integration</strong></p>
<ul>
<li><strong>Gutenberg</strong>: dedicated panel in the Document Settings sidebar.</li>
<li><strong>Quick Edit</strong>: token controls directly in the post list.</li>
<li><strong>Classic Editor</strong>: meta box in the editor sidebar.</li>
<li>Copy preview URL to clipboard with one click.</li>
<li>Update expiry without invalidating the current token.</li>
</ul>
<p><strong>Admin Settings</strong></p>
<ul>
<li>Set the external frontend URL (clicking “Open external preview” navigates directly to this URL).</li>
<li>Configure allowed CORS origins (multiple, with wildcard support — <code>https://*.example.com</code>).</li>
<li>Choose the minimum WordPress role required to issue tokens (Subscriber <span aria-hidden="true" class="wp-exclude-emoji">→</span> Administrator).</li>
<li>Tune rate limiting (requests per time window).</li>
<li>Optionally permit no-expiry tokens.</li>
</ul>
<p><strong>Issued Tokens List</strong></p>
<ul>
<li>View all active and expired tokens with post title, status, expiry, and issuer.</li>
<li>Revoke individual tokens or bulk-delete expired ones — all from the Settings screen.</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>HTTPS required for the preview endpoint (overridable for local development).</li>
<li>Per-IP rate limiting with configurable thresholds (default: 30 req / 60 s).</li>
<li>Role-based access control for token issuance.</li>
<li>CORS headers only sent for explicitly configured origins; WP core’s permissive echo-back is suppressed.</li>
<li><code>Referrer-Policy: no-referrer</code> prevents token leakage via referer headers.</li>
<li>Tokens are only valid for <code>draft</code>, <code>pending</code>, and <code>future</code> post statuses.</li>
<li>Admin-only settings page with defence-in-depth capability checks.</li>
<li>CSRF protection on all admin actions (nonce verification).</li>
</ul>
<p><strong>Audit Logging</strong></p>
<ul>
<li>Logs token issuance and usage events (post ID, user ID, client IP).</li>
<li>Logs security events: invalid token attempts, rate-limit violations, capability denials.</li>
<li>Output goes to <code>WP_DEBUG_LOG</code> by default; point to a dedicated file with <code>PVT_LOG_FILE</code>.</li>
</ul>
<p><strong>Internationalisation</strong></p>
<ul>
<li>Ships with Japanese (ja) and Simplified Chinese (zh_CN) translations.</li>
<li>All admin UI strings are translation-ready.</li>
</ul>
<h4>Developer Hooks</h4>
<p><strong>Filter</strong></p>
<ul>
<li><code>yuipt_preview_response_data</code> — Modify the REST API response data before it is sent.</li>
</ul>
<p><strong>Actions</strong></p>
<ul>
<li><code>yuipt_token_issued( int $post_id, int $user_id )</code> — Fires after a token is issued.</li>
<li><code>yuipt_token_used( int $post_id, int $user_id )</code> — Fires when a token is used successfully.</li>
<li><code>yuipt_invalid_token( string $ip )</code> — Fires on an invalid/expired token attempt.</li>
<li><code>yuipt_rate_limit_exceeded( string $ip, string $endpoint )</code> — Fires when rate limit is hit.</li>
<li><code>yuipt_capability_denied( int $user_id, int $post_id )</code> — Fires on a capability denial.</li>
</ul>
<p><strong>Constants (wp-config.php)</strong></p>
<ul>
<li><code>PVT_SKIP_HTTPS_CHECK</code> — Set to <code>true</code> to disable the HTTPS requirement (development only).</li>
<li><code>PVT_LOG_FILE</code> — Absolute path to a dedicated audit log file.</li>
</ul>
<h4>Use Case</h4>
<p>This plugin is designed for <strong>headless WordPress</strong> setups where a decoupled frontend (e.g. Astro, Next.js, Nuxt, SvelteKit) renders content from the WordPress REST API. It gives content editors a simple, secure way to share draft previews with stakeholders without granting them WordPress accounts or exposing long-lived API credentials.</p>


YUI Preview Token

Issue time-limited preview tokens for headless WordPress setups. Open drafts directly in your frontend URL without long-lived credentials.

Codevendor

<p>The Token Manager allows web developers to program PHP, HTML, CSS and JavaScript into tokens that can be used throughout WordPress. Tokens can be placed into themes, templates, pages, widgets, etc. The code in the token is processed and then injected into the token name. It allows web developers to package their code into components for easy reuse and maintenance while speeding up development time and distribution. The tokens are also aware of WordPress and can utilize all the common libraries and database from within the token. This allows for unlimited possibilities with web page design, third party api, WordPress api, PHP frameworks, web 2.0, other WordPress plugins, etc. The tokens can even be used within other tokens for replacement of text, making HTML, CSS, JS, fully dynamic.</p>
<h4>MultiSite</h4>
<p>The Token Manager has been built to work with WordPress MultiSite as well as single blog installations. By activating it on the network, it will add the capabilities to control tokens across WordPress sites and blogs. It will also store all tokens in custom tables that are not attached to WordPress, allowing for easy upgrades, backup and version changes.</p>
<h4>Token Management</h4>
<p>The management of tokens is very simple, with built in ajax controls to allow assignment of tokens to individual and all pages. It also separates out frontpage assignment, giving you the freedom to control exactly what is seen on the frontpage. The manager also keeps track of who created and last updated the tokens in WordPress.</p>
<h4>Token Parameters</h4>
<p>The Token Manager now supports token parameters. You can specify a string or integer parameter by adding them behind the token name. You can then access the parameter from within the token code, allowing for unlimited code possibilities.</p>
<h4>Error Handling</h4>
<p>PHP and token errors are handled by the Token Manager and can be displayed by turning on custom settings in the manager. This gives developers the full control to know where errors are occurring within their token code. The error setting can also be turned off for live sites. This protects you from displaying error information on public sites. All errors that occur in the tokens, unless fatal, will not stop the webpage from being displayed. So feel free to code your ideas without worring about errors halting WordPress.</p>
<h4>Token Manager (Standard) Features</h4>
<ul>
<li>Dynamic Processes PHP, HTML, CSS, JS</li>
<li>Token Management, Add, Edit, Delete</li>
<li>Token Parameters</li>
<li>Token Process Ordering</li>
<li>Token Page Assignment</li>
<li>Token Statistics</li>
<li>Token Descriptions</li>
<li>Custom Token Types</li>
<li>Custom Searching and Recordsets</li>
<li>Supports WordPress MultiSite</li>
<li>WordPress aware Tokens</li>
<li>Tokens within Tokens</li>
<li>Error Handling on Webpage, PHP and Tokens</li>
<li>Quick Help Question Marks</li>
</ul>
<h4>Token Manager (Professional) Features</h4>
<ul>
<li>All Standard Features</li>
<li>Global Tokens</li>
<li>External Scripts</li>
<li>Code Versioning</li>
<li>Token History</li>
<li>Backup and Restore Systems</li>
<li>Error Management Systems</li>
<li>Online Technical Support</li>
</ul>
<h4>Future Enhancements For Both</h4>
<ul>
<li>WordPress Token Injection Menus</li>
<li>Code Optimization</li>
<li>Sorting Systems</li>
<li>Better Searching</li>
</ul>
<p>If you have any enhancement suggestions or want to report a bug, please visit http://www.codevendor.com/support/</p>


Token Manager

The Token Manager allows web developers to program PHP, HTML, CSS and JavaScript into tokens that can be used throughout WordPress.

YUI Preview Token vs Token Manager