Mediagraph

This plugin connects your WordPress site to your Mediagraph digital asset

library. Editors browse collections, storage folders, and lightboxes from inside

the editor and insert assets in a couple of clicks.

This plugin is a client for Mediagraph, a paid third-party digital asset

management service. It does nothing on its own: a Mediagraph account is required,

and the plugin is only useful to organizations that already have a library there.

Assets you choose are copied into the WordPress media library and inserted as

standard WordPress blocks. That is the important part: a Mediagraph image is an

ordinary attachment, so cropping, rotation, alignment, image sizes, captions,

alt text, srcset, and the Replace button all behave exactly as they do for a

file you uploaded yourself.

Features

• Secure OAuth 2.0 with PKCE — no client secret stored on your site

• Browse collections, storage folders, and lightboxes with lazy-loaded trees

• Full-text search plus filters for file type, rights status, creator, capture

date, and custom metadata

• A Mediagraph option beside Upload and Media Library in every media block

• Multi-select for galleries and the classic editor

• Automatic file-type narrowing — a Video block only offers videos

• A Mediagraph tab in the standard WordPress media modal

• Usage reporting back to Mediagraph when a post is published

• Assets are never downloaded twice; re-inserting reuses the existing file

Supported blocks

Image, Gallery, Audio, Video, Cover, File, Media & Text, Site Logo, and any

third-party block built on the standard WordPress media placeholder.

External Service

This plugin relies on Mediagraph, a third-party digital asset management

io). The plugin is a

client for that service and cannot function without an account on it.

Nothing is sent anywhere until an administrator explicitly connects the site

under Settings → Mediagraph. 0 authorization at

io; you sign in there and approve access, and the site stores the

resulting access and refresh tokens. No password ever reaches WordPress, and no

client secret is stored on your site.

io in these cases:

• When an editor opens the picker, to list collections, storage folders and

lightboxes, and to load the filter options for your library.

• When an editor searches or filters, sending the search text and the chosen

filters so the service can return matching assets.

• When an editor inserts an asset, to fetch that asset’s metadata and download

the file into your WordPress media library. Mediagraph records this as a

download against your account.

-

When a post containing Mediagraph assets is published or updated, so the

library can record where an asset has been used. This report is the most

substantial thing the plugin sends, and it includes: which assets appear and

how they are used, your site name, the post’s title, permalink, publication

date, excerpt and author display name, and the post’s body as plain text.

This includes password-protected posts: their full body text is sent, just

like any other post’s.

The body is included so newsrooms can find the story an asset ran in from

inside Mediagraph. It is capped at 100,000 characters, and you can shorten or

disable it with the mediagraph_article_text_limit filter — setting it to 0

sends no body text. Posts with no Mediagraph assets are never reported.

• Periodically, to exchange an expired access token for a fresh one.

The site’s own admin URL is sent as part of the OAuth redirect so the service

can return the browser to your site after authorization.

Nothing is sent about visitors to your site, no analytics or telemetry are

collected, and the plugin adds no markup, links or credits to your public pages.

Mediagraph’s terms and privacy policy govern the data handled by the service:

• Terms of Service: https://www.mediagraph.io/terms-of-service

• Privacy Policy: https://www.mediagraph.io/privacy-policy

Building From Source

Development happens in the open at

com/mediagraph-io/mediagraph-wordpress — that repository is the

canonical source, and it is also where to report a bug or send a patch.

You do not need it to verify this plugin, though. The JavaScript in

admin/js/dist/ is compiled, so this package ships the unminified sources it is

built from, along with the tooling needed to reproduce them. Nothing is

obfuscated and no build step is hidden.

• Sources: admin/js/src/ (the picker and the block editor integration)

• Tooling: webpack.config.js, babel.config.js, package.json,

json

• Tests: admin/js/__tests__/

js 18 or newer:

npm ci npm run build

js and

js. npm run lint and npm test also

run against the shipped sources. React and the WordPress packages are treated as

externals and are not bundled — the plugin uses the copies WordPress provides.

Support

io