Skip to main content
The WordPress lane publishes posts to a self-hosted or WordPress.org site through its REST API. It publishes only once a WordPress credential is present in your .env; until then the lane is live-but-unauthenticated and waits for you to connect it (set PENDPOST_MODE=mock to exercise it through the mock driver). You own your WordPress site and are responsible for its terms of service. pendpost drafts and schedules, but a human approves before anything goes live.

​
Setup ceremony

The engine talks to the site’s own REST API at <site>/wp-json/wp/v2, enabled by default on WordPress 5.6+. Authentication is an application password on the posting user, so there is no app to register and no OAuth.
  1. Record the site URL. Record the site root, for example https://blog.example.com.
  2. Pick the posting user. Posts publish as this user, so use an Author or Editor account you control. Record its username (the login name, not the display name).
  3. Create an application password. In wp-admin open Users > Profile > Application Passwords, name it (for example pendpost), and create it. Copy the generated password immediately, because WordPress shows it once. Spaces in it are fine and accepted verbatim.
Then validate. It calls /users/me and confirms the account can publish posts:

​
Environment variables

A lane publishes only once its credential is present. If the WordPress variables are blank, the WordPress lane is live-but-unauthenticated and waits for you to connect it. Set PENDPOST_MODE=mock to exercise it through the mock driver.

​
Validate the lane

A present credential is not the same as a working one. After setup, validate the WordPress lane in the Setup tab, or run a live probe with the health_recheck tool, to confirm the credential is live and not just configured. The lane is ready when it reports live.
Over MCP. Setup and rotation are an interactive human ceremony; secrets are never written through MCP. An agent can still check status (account_status), run a live liveness probe (health_recheck), and read non-secret config (config_get) over MCP without touching credentials.

​
Common failures