Sticklight

Sticklight Connector securely connects your WordPress site to Sticklight, an AI app-building platform for creating web applications, dashboards, internal tools, and custom interfaces powered by your existing WordPress data.

The plugin extends the WordPress REST API with additional endpoints that allow authenticated Sticklight projects and external applications to retrieve user context and interact with permitted WordPress data. This allows the Sticklight agent to work with content and functionality exposed through WordPress while continuing to respect WordPress authentication, user roles, and capability checks.

Sticklight does not replace WordPress authentication or bypass WordPress permissions. It relies on WordPress authentication APIs for credential validation, uses WordPress Application Passwords for API access, and applies standard capability checks (current_user_can) to protected requests.

With WordPress connected to Sticklight, you can use natural-language instructions to build applications and tools around the data already stored in your site — without replacing WordPress as your CMS or backend.

For WooCommerce sites, the Sticklight Connector can also provide authenticated access to WooCommerce data and functionality exposed through the WordPress REST API. This allows Sticklight projects to build custom dashboards, internal tools, storefront experiences, and workflows around products, orders, customers, inventory, and other WooCommerce resources, subject to the permissions and capabilities of the connected WordPress user.

For example, Sticklight can be used to create tailored order-management interfaces, product and inventory tools, customer-facing experiences, or operational dashboards that work with the data already managed in WooCommerce.

Typical use cases

• Build AI-generated applications, dashboards, and internal tools powered by WordPress data
• Create custom interfaces for managing WordPress content outside wp-admin
• Build headless or hybrid WordPress frontends
• Create editorial, content-management, or operational workflows around existing WordPress data
• Build tools using data exposed by compatible WordPress plugins, including WooCommerce
• Connect React applications to the WordPress user and permission system
• Give authenticated applications controlled access to WordPress REST API resources

Features

• Securely connects WordPress with Sticklight projects
• Enables the Sticklight agent to work with authorized WordPress data through the REST API
• Authenticates through WordPress and issues Application Passwords for subsequent API access
• Adds REST endpoints for login, logout, and retrieving current user context
• Preserves WordPress roles and capability checks
• Supports cross-origin and headless WordPress architectures
• Works with resources exposed through the WordPress REST API
• Extensible through WordPress hooks and filters

About Sticklight

Sticklight is an AI app-building platform that lets users create production-ready applications and tools through natural-language instructions. The WordPress Connector allows those applications to work with live WordPress content and data while retaining WordPress as the underlying content, user, and permissions system.

Learn more about Sticklight for WordPress.

Read the WordPress Connector documentation.

Usage

Login

Authenticate with username (or email) and password:

POST /wp-json/sticklight/v1/auth/login

On success the response includes an Application Password for subsequent API requests and the authenticated user:

{
  "app_password": "XXXX XXXX XXXX XXXX XXXX XXXX",
  "user": {
    "user_id": 1,
    "username": "admin",
    "display_name": "Admin",
    "email": "[email protected]",
    "roles": ["administrator"]
  }
}

Use the returned app_password with HTTP Basic Authentication for all further requests.

Current user

Retrieve the current authenticated user:

GET /wp-json/sticklight/v1/auth/me

Logout

Revoke the current Application Password session:

POST /wp-json/sticklight/v1/auth/logout

User registration

User creation is handled through the built-in WordPress REST API (POST /wp-json/wp/v2/users) and requires administrator authentication.

Accessing protected data

Requests to any endpoint must pass standard WordPress permission checks. Sticklight does not bypass or override these checks.

Security

Sticklight follows WordPress security practices:

• Delegates credential validation to WordPress authentication APIs and uses WordPress Application Passwords for subsequent API access
• Issues Application Passwords scoped to individual sessions
• Does not provide user registration — accounts must be created by an administrator
• Applies capability checks (current_user_can) on all endpoints
• Does not expose private data without proper permissions

For external applications, it is recommended to:

• Use HTTPS
• Restrict allowed origins
• Avoid exposing sensitive endpoints unnecessarily