WordPress plugin

Overview#

The reblogger WordPress plugin is a thin client on top of the public API. It uses a site-scoped API key obtained through a one-click connect flow — you never copy and paste keys — and it creates articles with POST /articles, then imports them using ?include=blocks.

Connecting a site#

1. 1Start in WordPressIn wp-admin open reblogger → Connect. The plugin creates a random state value and sends you to reblogger.ai.
2. 2Approve on reblogger.aiSign in (or create a free account) and approve the connection for that exact site URL.
3. 3Back to WordPressYou are redirected back with a one-time code. The plugin checks the state value to prevent CSRF.
4. 4Exchange the codeThe plugin calls POST /connect/exchange from the server and stores the returned site-scoped API key in the WordPress options table.

Each connected site appears under Sites in your dashboard. Your plan determines how many sites you can connect.

The code exchange#

This endpoint needs no API key — the one-time code is the credential. Codes expire after a few minutes, work exactly once, and only for the site URL that started the flow (scheme, www. and trailing slashes are ignored).

<?php
$response = wp_safe_remote_post('https://reblogger.ai/api/v1/connect/exchange', [
    'timeout' => 15,
    'headers' => ['Content-Type' => 'application/json'],
    'body'    => wp_json_encode([
        'code'     => sanitize_text_field(wp_unslash($_GET['code'])),
        'site_url' => home_url('/'),
    ]),
]);
$data = json_decode(wp_remote_retrieve_body($response), true);
if (wp_remote_retrieve_response_code($response) === 200) {
    update_option('reblogger_api_key', $data['api_key'], false); // not autoloaded
    update_option('reblogger_site_id', $data['site']['id']);
}

{
  "api_key": "rb_live_…",
  "site": { "id": "cmh1x0sit4c1p0001", "url": "https://myblog.example" },
  "account": { "email": "[email protected]", "plan": "starter", "credits": 30 }
}

Any problem — unknown, expired or used code, or a different site URL — returns 400 invalid_connect_code; start the flow again. The endpoint is rate-limited per IP.

Generating & publishing#

• Articles are created with the site key, so they show up as source wordpress in your dashboard and use your account's credits.
• The plugin passes a callback_url on the site so it hears about finished articles immediately; WP-Cron polling is only a fallback. Because callbacks are unsigned, the plugin always re-fetches the article with its key.
• Content is imported from content_blocks (native Gutenberg blocks). Images are sideloaded into the media library; the cover becomes the featured image with its alt text.
• meta_title, meta_description and focus_keyword are written to Yoast SEO, Rank Math or SEOPress when active; tags and categories are mapped to WordPress taxonomies.
• Posts are saved as drafts by default; you can publish immediately or schedule them.

Disconnecting#

Clicking Disconnect in the plugin calls this endpoint with the site key: the key is revoked and the site is removed from your account. Articles stay in your library. You can also disconnect a site from the dashboard, which revokes its key the same way.

Security#

• The site key is stored server-side in the options table (not autoloaded) and is never sent to the browser.
• All admin actions use nonces and capability checks; all requests use wp_safe_remote_* over HTTPS.
• Revoking the site in your dashboard immediately cuts off the plugin — no secret on the site remains valid.