Oscar SEO Connector replaces the Application Password flow that Oscar previously used to publish to self-hosted WordPress sites.

Instead of a broad, account-wide Application Password, this plugin issues a single, narrow connection token that Oscar uses to call a small, dedicated REST API:

Verify the connection (ping).
Create or update a post, including title, content, excerpt, slug, status, categories, tags and a meta description (publish).
Upload an image to the media library, from a URL or a direct file upload, for use as a featured or inline image (media).
Optionally remove a post that Oscar created (post/{id}).

Security first

The connection token is generated with a cryptographically secure random source and only its hash is ever stored in the database. The plaintext is shown exactly once, right after it is generated.
Every request is authenticated with a Bearer token compared using a constant-time (hash_equals) check — no valid token, no access.
Every REST route has an explicit permission check; none are public.
All admin actions are nonce-protected and require the manage_options capability.

SEO plugin compatibility

When present, the meta description Oscar sends is also written to the fields read by Yoast SEO and Rank Math, in addition to the plugin’s own field, so existing SEO plugins keep working without any extra configuration.

External services

This plugin connects your WordPress site to Oscar SEO (https://oscar-seo.ai), a third-party content platform that you must have an account with. The connection is initiated by you: you install this plugin, generate a connection token, and paste it into your Oscar account.

What data is exchanged and when:

Oscar calls this site’s REST API (the oscar/v1 endpoints) using the connection token you provide, to verify the connection and to create or update posts (title, content, excerpt, slug, status, categories, tags, meta description).
When a post includes images, the plugin downloads those images from the URLs Oscar provides and adds them to your Media Library.
The plugin itself does not send your site’s data to Oscar and does not track your site or its visitors. All requests are initiated by Oscar using the token you authorized, and the connection can be revoked at any time by regenerating or removing the token.

By connecting, you agree to Oscar SEO’s Terms of Service (https://oscar-seo.ai/cgv) and Privacy Policy (https://oscar-seo.ai/confidentialite).