Authorising a site
Media CDN and Realtime each need your WordPress site to authorise them. This is a different connection from the builder’s, and understanding the difference saves confusion.
Two different connections
Section titled “Two different connections”| Builder connection | Service authorisation | |
|---|---|---|
| What it connects | The app builder to your site | One add-on service to your site |
| How you authenticate | A WordPress application password | An approve-and-exchange handshake |
| What it can do | Read your plugins, forms, members | Only what that service needs |
| Set up in | The app’s Connection settings | The service’s own screen |
A service authorisation is scoped to that service. Authorising Media CDN does not give it your application password, and revoking one has no effect on the other.
The handshake
Section titled “The handshake”- Open the service’s screen in the builder — Media CDN or Realtime.
- Start the connection. You are taken to an Authorize this site screen showing which site is asking and what it will be allowed to do.
- Approve it. Your site and the service exchange a token.
- The service screen shows the site as connected.
The token is issued to your site and held there. It can be rotated later from the same screen without redoing the whole handshake.
Revoking
Section titled “Revoking”Disconnect the site from the service’s screen. The token stops working immediately.
For Media CDN, the consequence is that images fall back to loading from your origin — slower, not broken. For Realtime, the consequence is that the app goes back to refreshing on demand.
Neither breaks your app, which is the point of keeping these separate from the builder connection.
Rotating a token
Section titled “Rotating a token”Rotate rather than revoke when you want to invalidate a token without interrupting the service — the new token is issued before the old one stops working.
Rotate if you have reason to think a token was exposed, or as routine hygiene when someone with access to your site’s admin leaves.
When it does not work
Section titled “When it does not work”| Symptom | Cause | Fix |
|---|---|---|
| The approve screen never appears | Pop-ups blocked, or the site is unreachable | Allow pop-ups and confirm the site is public |
| Approved, but the service shows disconnected | The exchange did not complete | Start the handshake again |
| The site authorised the wrong app | You approved from a different app’s screen | Disconnect and redo it from the right one |
| It worked and then stopped | The token was revoked or rotated elsewhere | Reconnect from the service screen |