Authenticate WordPress

Before publishing existing docs, configure the Bearer token DocsPress sends to the WordPress Pages REST endpoint. Store it as the GitHub Actions secret WP_ACCESS_TOKEN.

WordPress.com

Create an application at WordPress.com Apps with this callback URL:

http://localhost:8787/callback

The current helper requests the WordPress.com global scope. Run the exact trusted package version locally and use --set-secret so the token is written to GitHub without being printed:

bash Trusted local terminal

printf "WordPress.com client secret: "IFS= read -r -s DOCSPRESS_CLIENT_SECRETprintf "\n"npx docspress@0.2.0 token \  --client-id YOUR_CLIENT_ID \  --client-secret "$DOCSPRESS_CLIENT_SECRET" \  --site example.wordpress.com \  --repo OWNER/REPO \  --set-secretunset DOCSPRESS_CLIENT_SECRET

The masked prompt keeps the client secret out of shell history; the helper stores WP_ACCESS_TOKEN through GitHub CLI.

Run this yourself

The helper currently passes the client secret as a process argument. Use a trusted local machine, avoid screen or session recording, and do not ask an agent to capture the command or its output.

Verify only the secret name:

gh secret list --repo OWNER/REPO

Self-hosted WordPress

Set wordpress-url to the site origin, without /wp-json. DocsPress will call /wp-json/wp/v2/pages and send Authorization: Bearer ….

Core WordPress does not create that Bearer token for DocsPress. Configure a trusted authentication mechanism that accepts it, then store the resulting token as WP_ACCESS_TOKEN.

Continue with the first synchronization.