# Sign-in for AI apps

> Apps that can sign in connect with just your site's address. You sign in to WordPress, choose what the app may do and click Allow.

Sign-in lets an AI app connect with only your site's address. The app sends you to your site, you sign in to WordPress, choose what the app may do and click **Allow**. No key is copied, and the connection keeps working while your computer is off.

> [!NOTE] Sign-in is new in PowerWP AI 1.6. It follows the MCP authorization specification (OAuth 2.1).

## How it works for you

:::steps
1. In your AI app, add your site's MCP address as a custom connector or server. The address is `https://your-store.com/wp-json/wpai/v1/mcp`. The steps for each app are on the [Claude](/docs/connect/claude/) and [ChatGPT](/docs/connect/chatgpt/) pages.
2. The app opens your site's sign-in. If you are signed out, WordPress asks you to sign in first, and a two-factor plugin works as usual. Only an administrator can approve an app.
3. Check the approval screen. It names the app, shows **Answer goes to** (the address the app registered, which an app cannot fake) and who is signed in.
4. Choose a preset: Read-only diagnostics, Content manager, Developer or Full access. Full access is never preselected for a new connection.
5. Click **Allow**, or **Cancel** to refuse. The app finishes connecting by itself.
:::

The connection appears under **PowerWP AI › Connections** with a **Signed in** badge. If the same app signs in again for the same administrator, it keeps its connection and takes the permissions you choose then. There are no duplicates.

## What you need

- A site address that the app can reach from the internet. An app that runs in the cloud cannot reach a site on your own computer. For a local site, use an app on the same computer.
- HTTPS on a public site.
- Pretty permalinks. Under **Settings › Permalinks** in WordPress, choose any structure except Plain.
- **Settings › Connection security › Sign-in for AI apps** switched on. It is on by default.
- A plan that allows the connection. The same limits apply as for a connection with a key: Free allows read-only, a site without a license gets no new connection, and the plan's connection count includes signed-in apps. See [Plans and limits](/docs/concepts/plans/).

## Which apps can use it

The plugin has sign-in steps for Claude (claude.ai, the Claude app and the phone apps) and for ChatGPT, where you add your site as a custom MCP server with OAuth. Any other app that follows the MCP authorization specification can also ask to sign in. PowerWP AI shows a warning on the approval screen for apps it does not know, and asks you to continue only if you started the connection yourself.

## Tokens and lifetimes

After you click Allow, the app receives tokens of its own. They act for the connection: its permissions, plan limits, change log and rate limit.

| Token | Lifetime |
|---|---|
| Authorization code | 5 minutes, one use. A second use ends everything the code gave out. |
| Access token | 1 hour. The app renews it by itself. |
| Refresh token | 60 days, renewed each time it is used. If an old refresh token is presented again, the app's whole sign-in ends. |

If an app is not used for 60 days, its refresh token runs out and the app has to sign in again. Every token is stored on your site only as a hash.

## If sign-in will not work for you

Sign-in needs a public HTTPS site and pretty permalinks. If it is not offered, or your site runs on your own computer, connect with a key instead: [Claude Code](/docs/connect/claude-code/), [Codex](/docs/connect/codex/) or [another app](/docs/connect/other-apps/). Rescue mode works for apps that connect with a key and, since PowerWP AI 1.6.5, for apps that signed in, such as Claude and ChatGPT. The app must already be connected when the site breaks: signing in for the first time, or again after 60 days without use, goes through the WordPress login, which the crash can take down too.

## Manage and revoke

- Edit a signed-in connection's permissions in **PowerWP AI › Connections**.
- Revoke it there, and every token of that app ends at once.
- Switch off **Settings › Connection security › Sign-in for AI apps** to pause every signed-in app. Switch it on again and they carry on. Connections with a key are not affected.

## Everything stays on your site

Your site is both the protected resource and its own sign-in server. No PowerWP server takes part, and no token leaves your site except to the app that signed in. Signed-in apps often call from addresses shared with other customers, so they send no new-IP alert, and expired or ended tokens do not count towards the failed-attempt lockout.

## For developers

PowerWP AI requires PKCE (S256) and supports dynamic client registration and client ID metadata documents. Without a credential, the MCP endpoint answers 401 with a pointer to its discovery document.

| Purpose | Address on your site |
|---|---|
| MCP endpoint | `/wp-json/wpai/v1/mcp` |
| Protected-resource metadata | `/wp-json/wpai/v1/oauth/protected-resource` |
| Server metadata | `/wp-json/wpai/v1/oauth/.well-known/oauth-authorization-server` |
| Registration | `/wp-json/wpai/v1/oauth/register` |
| Approval screen | `/wp-admin/admin-post.php?action=powerwp_connect` |
| Token and revocation | `/wp-json/wpai/v1/oauth/token` and `/wp-json/wpai/v1/oauth/revoke` |

:::cards
- [Claude](/docs/connect/claude/) — Add your site as a connector.
- [ChatGPT](/docs/connect/chatgpt/) — Add your site as a custom MCP server.
- [Connections and keys](/docs/concepts/connections/) — Manage and revoke connections.
- [Keys and access control](/docs/security/access-control/) — What protects a connection.
:::

Source: https://powerwp.ai/docs/concepts/sign-in/