Sticklight

Features

• Securely connects WordPress with Sticklight projects
• Enables the Sticklight agent to work with authorized WordPress data through the REST API
• Authenticates through WordPress and issues Application Passwords for subsequent API access
• Adds REST endpoints for login, logout, and retrieving current user context
• Preserves WordPress roles and capability checks
• Supports cross-origin and headless WordPress architectures
• Works with resources exposed through the WordPress REST API
• Extensible through WordPress hooks and filters

About Sticklight

Sticklight is an AI app-building platform that lets users create production-ready applications and tools through natural-language instructions. The WordPress Connector allows those applications to work with live WordPress content and data while retaining WordPress as the underlying content, user, and permissions system.

Learn more about Sticklight for WordPress .

Read the WordPress Connector documentation.

Usage

Login

Authenticate with username (or email) and password:

POST /wp-json/sticklight/v1/auth/login

On success the response includes an Application Password for subsequent API requests and the authenticated user:

{ "app_password": "XXXX XXXX XXXX XXXX XXXX XXXX", "user": { "user_id": 1, "username": "admin", "display_name": "Admin", "email": "admin@example.com", "roles": ["administrator"] } }

Use the returned app_password with HTTP Basic Authentication for all further requests.

Current user

Retrieve the current authenticated user:

GET /wp-json/sticklight/v1/auth/me

Logout

Revoke the current Application Password session:

POST /wp-json/sticklight/v1/auth/logout

User registration

User creation is handled through the built-in WordPress REST API ( POST /wp-json/wp/v2/users ) and requires administrator authentication.

Accessing protected data

Requests to any endpoint must pass standard WordPress permission checks. Sticklight does not bypass or override these checks.

Security

Sticklight follows WordPress security practices:

• Delegates credential validation to WordPress authentication APIs and uses WordPress Application Passwords for subsequent API access
• Issues Application Passwords scoped to individual sessions
• Does not provide user registration — accounts must be created by an administrator
• Applies capability checks ( current_user_can ) on all endpoints
• Does not expose private data without proper permissions

For external applications, it is recommended to:

• Use HTTPS
• Restrict allowed origins
• Avoid exposing sensitive endpoints unnecessarily