About this plugin
SimplyMade Connector lets a site administrator authorize a read-only site
identity check for a client workspace in SimplyMade Social. A SimplyMade
website plan and client portal account are required for the hosted service.
The plugin does not publish, edit, delete, track visitors, add users, or create
WordPress Application Passwords. Installing or activating it makes no outbound
request. The administrator explicitly clicks Connect to begin pairing.
The WordPress REST route /wp-json/simplymade/v1/connection returns the site
address, blog ID, authorizing user ID, grant ID, HTTPS status, and read-only
scope to a caller presenting the plugin’s scoped token. The token does not
authorize WordPress core post, page, theme, or plugin APIs. Publishing would
require a separate, explicit future authorization and is not part of this
read-only pairing.
External service: when the administrator clicks Connect to SimplyMade, the
plugin sends a short-lived, one-use code, canonical HTTPS site address, random
grant ID and freshly generated scoped token to
com/v1/wordpress/plugin-pair over verified
HTTPS. SimplyMade checks the code against the portal requester, workspace and
site, then stores the token encrypted. SimplyMade later sends the token only
in a read-only HTTPS connection-check request to this site’s route. The site
stores a SHA-256 token digest, grant ID, authorizing user ID and state in a
non-autoload WordPress option; it does not store the token in plaintext. The
service stores connection identity, state, and verification results. No data
is sent before the administrator clicks Connect, and there is no visitor
tracking or telemetry from this plugin. See the SimplyMade privacy policy
and terms.