Connect your Consepo account

Connect the site with a Consepo token so it can scan, read its suggested policy and point violation reports at Consepo. The hash tool, nonces and integrity pinning work without connecting.

Connect with a token

1. 1

   Create the token in Consepo

   In Consepo, open API tokens and create a WordPress plugin token. Give it the site’s domain, for example example.com; subdomains such as www are included. Copy the token: Consepo shows it once.

2. 2

   Paste it into WordPress

   In WordPress, open Settings → Consepo → Account and paste the token into Token.

3. 3

   Connect

   Choose Connect in the page header. A snackbar confirms Consepo account connected. and the header badge changes to Connected.

What the plugin checks when you choose Connect:

1. The token has the Consepo shape: csp_ followed by 48 lowercase hex characters, 52 characters in all.
2. Consepo accepts it. The plugin asks Consepo's /v1/tools/hashes to hash a short string, which needs a valid token and creates nothing.
3. Only then is it stored.

Where the token is kept

The token is stored in the consepo_csp_scanner_credentials option, which is not autoloaded. It is sealed with libsodium's secretbox under a key derived from wp_salt( 'secure_auth' ), so a database dump on its own does not hand over a working token; on a PHP build without sodium it is stored unsealed. It never reaches the browser: the admin screen only learns whether a token is set. Changing the site's secure-auth key or salt makes the stored token unreadable, and the site has to connect again.

Sign in with Consepo

When Consepo publishes OAuth 2.1 authorization server metadata at https://consepo.com/.well-known/oauth-authorization-server, a Sign in with Consepo button appears on the Account screen. No plugin update is needed. Until then the screen says signing in is on its way and offers the token field only.

When it is available:

• The site registers itself with Consepo as a public OAuth client for its own redirect address (the Account screen), and remembers the client.
• Each attempt uses PKCE (S256) and a one-time state that expires after ten minutes.
• Consepo sends you back to the Account screen, which completes the connection.
• The access token is refreshed a minute before it expires. Disconnecting revokes the tokens at Consepo when Consepo offers revocation.

The plugin checks for the metadata at most once an hour while it is missing, and caches it for 12 hours once found.

Disconnect

Under Account, choose Disconnect, then Yes, disconnect. Scans and status updates stop. The policy the site sends keeps working until you set the mode to Off under Policy, and the site's scan stays bound, so reconnecting the same workspace carries on where it left off.

Use a staging or local Consepo

Point the plugin at another Consepo origin from wp-config.php:

define( 'CONSEPO_CSP_SCANNER_API_URL', 'http://localhost:8787' );