Sign-in for AI apps

Sign-in lets an AI app connect with only your site's address. The app sends you to your site, you sign in to WordPress, choose what the app may do and click Allow. No key is copied, and the connection keeps working while your computer is off.

How it works for you#

1. In your AI app, add your site's MCP address as a custom connector or server. The address is https://your-store.com/wp-json/wpai/v1/mcp. The steps for each app are on the Claude and ChatGPT pages.
2. The app opens your site's sign-in. If you are signed out, WordPress asks you to sign in first, and a two-factor plugin works as usual. Only an administrator can approve an app.
3. Check the approval screen. It names the app, shows Answer goes to (the address the app registered, which an app cannot fake) and who is signed in.
4. Choose a preset: Read-only diagnostics, Content manager, Developer or Full access. Full access is never preselected for a new connection.
5. Click Allow, or Cancel to refuse. The app finishes connecting by itself.

The connection appears under PowerWP AI › Connections with a Signed in badge. If the same app signs in again for the same administrator, it keeps its connection and takes the permissions you choose then. There are no duplicates.

What you need#

• A site address that the app can reach from the internet. An app that runs in the cloud cannot reach a site on your own computer. For a local site, use an app on the same computer.
• HTTPS on a public site.
• Pretty permalinks. Under Settings › Permalinks in WordPress, choose any structure except Plain.
• Settings › Connection security › Sign-in for AI apps switched on. It is on by default.
• A plan that allows the connection. The same limits apply as for a connection with a key: Free allows read-only, a site without a license gets no new connection, and the plan's connection count includes signed-in apps. See Plans and limits.

Which apps can use it#

The plugin has sign-in steps for Claude (claude.ai, the Claude app and the phone apps) and for ChatGPT, where you add your site as a custom MCP server with OAuth. Any other app that follows the MCP authorization specification can also ask to sign in. PowerWP AI shows a warning on the approval screen for apps it does not know, and asks you to continue only if you started the connection yourself.

Tokens and lifetimes#

After you click Allow, the app receives tokens of its own. They act for the connection: its permissions, plan limits, change log and rate limit.

If an app is not used for 60 days, its refresh token runs out and the app has to sign in again. Every token is stored on your site only as a hash.

If sign-in will not work for you#

Sign-in needs a public HTTPS site and pretty permalinks. If it is not offered, or your site runs on your own computer, connect with a key instead: Claude Code, Codex or another app. Rescue mode works for apps that connect with a key and, since PowerWP AI 1.6.5, for apps that signed in, such as Claude and ChatGPT. The app must already be connected when the site breaks: signing in for the first time, or again after 60 days without use, goes through the WordPress login, which the crash can take down too.

Manage and revoke#

• Edit a signed-in connection's permissions in PowerWP AI › Connections.
• Revoke it there, and every token of that app ends at once.
• Switch off Settings › Connection security › Sign-in for AI apps to pause every signed-in app. Switch it on again and they carry on. Connections with a key are not affected.

Everything stays on your site#

Your site is both the protected resource and its own sign-in server. No PowerWP server takes part, and no token leaves your site except to the app that signed in. Signed-in apps often call from addresses shared with other customers, so they send no new-IP alert, and expired or ended tokens do not count towards the failed-attempt lockout.

For developers#

PowerWP AI requires PKCE (S256) and supports dynamic client registration and client ID metadata documents. Without a credential, the MCP endpoint answers 401 with a pointer to its discovery document.