This plugin connects your WordPress site to your Mediagraph digital asset
library. Editors browse collections, storage folders, and lightboxes from inside
the editor and insert assets in a couple of clicks.

This plugin is a client for Mediagraph, a paid third-party digital asset
management service. It does nothing on its own: a Mediagraph account is required,
and the plugin is only useful to organizations that already have a library there.

Assets you choose are copied into the WordPress media library and inserted as
standard WordPress blocks. That is the important part: a Mediagraph image is an
ordinary attachment, so cropping, rotation, alignment, image sizes, captions,
alt text, srcset, and the Replace button all behave exactly as they do for a
file you uploaded yourself.

Features

Secure OAuth 2.0 with PKCE — no client secret stored on your site
Browse collections, storage folders, and lightboxes with lazy-loaded trees
Full-text search plus filters for file type, rights status, creator, capture
date, and custom metadata
A Mediagraph option beside Upload and Media Library in every media block
Multi-select for galleries and the classic editor
Automatic file-type narrowing — a Video block only offers videos
A Mediagraph tab in the standard WordPress media modal
Usage reporting back to Mediagraph when a post is published
Assets are never downloaded twice; re-inserting reuses the existing file

Supported blocks

Image, Gallery, Audio, Video, Cover, File, Media & Text, Site Logo, and any
third-party block built on the standard WordPress media placeholder.

External Service

This plugin relies on Mediagraph, a third-party digital asset management
service operated by Mediagraph (https://www.mediagraph.io). The plugin is a
client for that service and cannot function without an account on it.

Nothing is sent anywhere until an administrator explicitly connects the site
under Settings Mediagraph. Connecting starts an OAuth 2.0 authorization at
mediagraph.io; you sign in there and approve access, and the site stores the
resulting access and refresh tokens. No password ever reaches WordPress, and no
client secret is stored on your site.

Once connected, the plugin contacts https://mediagraph.io in these cases:

When an editor opens the picker, to list collections, storage folders and
lightboxes, and to load the filter options for your library.
When an editor searches or filters, sending the search text and the chosen
filters so the service can return matching assets.
When an editor inserts an asset, to fetch that asset’s metadata and download
the file into your WordPress media library. Mediagraph records this as a
download against your account.
When a post containing Mediagraph assets is published or updated, so the
library can record where an asset has been used. This report is the most
substantial thing the plugin sends, and it includes: which assets appear and
how they are used, your site name, the post’s title, permalink, publication
date, excerpt and author display name, and the post’s body as plain text.

The body is included so newsrooms can find the story an asset ran in from
inside Mediagraph. It is capped at 100,000 characters, and you can shorten or
disable it with the mediagraph_article_text_limit filter — setting it to 0
sends no body text. Posts with no Mediagraph assets are never reported.
Periodically, to exchange an expired access token for a fresh one.

The site’s own admin URL is sent as part of the OAuth redirect so the service
can return the browser to your site after authorization.

Nothing is sent about visitors to your site, no analytics or telemetry are
collected, and the plugin adds no markup, links or credits to your public pages.

Mediagraph’s terms and privacy policy govern the data handled by the service:

Building From Source

Development happens in the open at
https://github.com/mediagraph-io/mediagraph-wordpress — that repository is the
canonical source, and it is also where to report a bug or send a patch.

You do not need it to verify this plugin, though. The JavaScript in
admin/js/dist/ is compiled, so this package ships the unminified sources it is
built from, along with the tooling needed to reproduce them. Nothing is
obfuscated and no build step is hidden.

Sources: admin/js/src/ (the picker and the block editor integration)
Tooling: webpack.config.js, babel.config.js, package.json,
package-lock.json
Tests: admin/js/__tests__/

From the plugin directory, with Node.js 18 or newer:

npm ci
npm run build

That regenerates admin/js/dist/mediagraph-picker.bundle.js and
admin/js/dist/mediagraph-blocks.bundle.js. npm run lint and npm test also
run against the shipped sources. React and the WordPress packages are treated as
externals and are not bundled — the plugin uses the copies WordPress provides.

Support

https://docs.mediagraph.io or [email protected]