Skip to content
WP Visibility

Connect an assistant

Create the Application Password Your Assistant Signs In With

Every assistant connects as a WordPress user through an Application Password. Make a dedicated user, give it only the role the work needs, and name the password after the client.

Updated September 21, 2026

Docs

Create a dedicated WordPress user for the assistant, open that user’s profile, add an Application Password named after the client, and copy it once. The assistant authenticates as that user, and everything it does is recorded under that user and that password’s name.

Why a dedicated user

An Application Password is a real login for the user it belongs to. It carries that user’s whole authority, not only the WP Visibility tools, so the user’s role is the boundary that matters:

  • Reading and updating the SEO fields of individual posts needs permission to edit those posts. An Editor covers every post; an Author covers its own.
  • Site settings, bulk SEO updates, redirects and proposal management need manage_options, which means an Administrator.

Give the user the smaller role if the assistant’s job allows it. An Administrator’s password can also reach WordPress routes outside the review queue, so choose it deliberately and read what the queue does and does not cover.

Create the password

  1. Go to Users → Add New User, create the user, and assign the role.
  2. Open that user’s profile (Users → All Users → the user) and scroll to Application Passwords.
  3. Enter a name that identifies the client, for example Claude Desktop or Claude Code on the laptop, and click Add New Application Password.
  4. Copy the password shown. It appears once. WordPress displays it in groups with spaces; the spaces may be kept or removed.

The name matters more than it looks: the activity log attributes every call to the user and this label, so one password per client tells you later which assistant did what.

HTTPS

WordPress offers Application Passwords only on sites served over HTTPS, apart from local development environments. If the section is missing from the profile, that is the reason. Put the site behind a certificate first.

How the client uses it

Clients that can send an HTTP header use Basic authentication: the header is Authorization: Basic followed by the base64 encoding of username:application-password. Clients that cannot send headers run a small local bridge that holds the username and password for them. The connection docs for Claude Desktop, Claude Code and other clients show where each one takes it.

Keep any file that contains the password private. It is a login.

Revoke it

From the same profile section, Revoke ends that password. Requests using it fail from then on. Revoking does not undo work already done, and it does not touch the user’s other passwords; to cut an assistant off completely, revoke its password and, if the user exists only for that assistant, delete the user.