Authorising a site
Media CDN, Realtime and Push each need your WordPress site to authorise them. This is a different connection from the builder’s, and understanding the difference saves confusion.
Two different connections
Section titled “Two different connections”| Builder connection | Service authorisation | |
|---|---|---|
| What it connects | The app builder to your site | One add-on service to your site |
| What it grants | A WordPress application password | A token scoped to that service |
| What it can do | Read your plugins, forms, members | Only what that service needs |
| Set up in | Memberside → Getting Started | The service’s own screen |
| Costs | Nothing, on every plan | Needs that service on your plan |
Both now use the same approve-and-exchange handshake, but they grant different things and in different directions. The builder connection hands memberside.app an application password so it can read and write on your site. A service authorisation is the reverse: your site receives a token, scoped to that one service, and memberside.app gets nothing it can act with.
So authorising Media CDN does not give it your application password, and revoking one has no effect on the other.
The handshake
Section titled “The handshake”- Open the service’s screen in WordPress under Memberside → Services.
- Start the connection. You are taken to an Authorize this site screen showing which site is asking and what it will be allowed to do.
- Approve it. Your site and the service exchange a token.
- The service screen shows the site as connected.
The token is issued to your site and held there. It can be rotated later from the same screen without redoing the whole handshake.
Revoking
Section titled “Revoking”Disconnect the site from the service’s screen. The token stops working immediately, and the service is switched off on Memberside → Services — a service with no connection has nothing to do.
To connect it again, switch the service back on. Its screen opens with Authorize this site; go through the handshake as before. The approve screen says the site was connected before and the button reads Reconnect — you still have to approve it, or the site stays disconnected. Approving switches the service back on.
For Media CDN, the consequence is that images fall back to loading from your origin — slower, not broken. For Realtime, the consequence is that the app goes back to refreshing on demand.
For Push the consequence is different in kind, and worth stating separately: your members stop receiving notifications. Nothing falls back, because there is nothing slower for a notification to become. Registered devices are forgotten, and members re-register on their next app launch if you reconnect.
None of the three breaks your app, which is the point of keeping these separate from the builder connection.
Rotating a token
Section titled “Rotating a token”Rotate rather than revoke when you want to invalidate a token without interrupting the service — the new token is issued before the old one stops working.
Rotate if you have reason to think a token was exposed, or as routine hygiene when someone with access to your site’s admin leaves.
When it does not work
Section titled “When it does not work”| Symptom | Cause | Fix |
|---|---|---|
| The approve screen never appears | Pop-ups blocked, or the site is unreachable | Allow pop-ups and confirm the site is public |
| Approved, but the service shows disconnected | The exchange did not complete | Start the handshake again |
| The site authorised the wrong app | You approved from a different app’s screen | Disconnect and redo it from the right one |
| It worked and then stopped | The token was revoked or rotated elsewhere | Reconnect from the service screen |
| Back in WordPress after reconnecting, still not connected | You left the approve screen without choosing Reconnect | Start again and approve it |