Fondoo
GitHubStart your 7-day trial for $0Start trial
Docs

Connect WordPress.com to Fondoo

Live4 min readUpdated

This guide is for sites hosted on WordPress.com. For WordPress on your own hosting, use the WordPress guide. You connect by signing in to WordPress.com and approving Fondoo for one site, with no passwords to copy. Your AI agent can then draft, update, schedule and publish posts and pages, and upload media.

What Fondoo can do with it

Fondoo works with the WordPress.com REST API for the one site you authorize (public-api.wordpress.com/wp/v2/sites/<site ID>):

  • Posts, pages and media: list, read, create and update. Media uploads accept JPEG, PNG, WebP or PDF, up to about 3 MB.
  • Delete posts, pages or media. This is destructive and needs your approval.

After you bind the connection to your Fondoo site with connect_cms:

  • update_page keeps a WordPress.com draft in sync with your Fondoo page.
  • publish_connected_page publishes it now, or schedules it for a future date. WordPress.com scheduling is supported.
  • map_cms_page links an existing post.
  • apply_seo_fixes can correct missing titles only. Descriptions and canonicals are not writable through this connector.

Approval rules:

  • Agents need your approval to publish unless you have turned on auto-publish.
  • Agents need your approval to delete content.
  • Agents need your approval to switch an already bound site to another CMS connection.

Before you start

  • A WordPress.com account that is an administrator or editor of the site.
  • A plan that allows API writes. WordPress.com's documentation does not state a plan requirement for writing through the REST API. One WordPress.com staff answer says a plugin-enabled plan is needed. This may differ for your account.
  • Sites with plugins. On sites where hosting features are active (all paid plans, usually after you install a first plugin), WordPress.com documents calling the site's own /wp-json/ address directly (REST API URLs by site type). Fondoo uses the public-api.wordpress.com route. If it fails for such a site, the self-hosted WordPress connector with an application password is the alternative.
  • A Fondoo site to connect it to.
  • Who registers the OAuth app. On hosted Fondoo, the WordPress.com app is already registered. If you run your own Fondoo server, the operator registers a WordPress.com developer app with the redirect URL <your Fondoo API>/oauth/wordpress/callback (OAuth2 docs). Without it, Fondoo answers "WordPress.com OAuth app is not configured".

Step by step: get your credentials

There is nothing to copy. Fondoo uses WordPress.com's standard sign-in and consent screen (OAuth2).

  1. Ask your agent to start the connection (next section). It receives an authorizationUrl that is valid for 15 minutes.
  2. Open the link while signed in to WordPress.com.
  3. WordPress.com shows an authorization screen for Fondoo. By default, the access it grants covers a single site. If asked, choose the site you want Fondoo to manage, then approve.
  4. WordPress.com sends you back to Fondoo. You will see "WordPress.com connected – Return to your agent and use connect_cms to select this connection."

Behind the scenes, Fondoo exchanges the one-time code for an access token and the site ID, and stores them encrypted. The token is never shown to you or the agent.

Connect it in Fondoo

In the dashboard: open Connections, find WordPress.com under Available → Content, and click Connect WordPress.com to get the setup steps. There is also a Use a key button, but it expects a raw access token and site ID, so the sign-in flow below is the recommended path.

By asking your agent. For example:

"Connect my WordPress.com blog to my Fondoo site."

The agent calls:

connect_wordpress_com({siteId})

It gives you the authorizationUrl. After you approve, the agent finds the new connection with list_connections({siteId}) and runs:

test_connection({connectionId})
connect_cms({siteId, connectionId})

If the connection's site has no public URL yet, connect_cms asks for settings.publicSiteUrl. connect_service({provider:"wordpress_com", siteId}) returns a signed 15-minute instruction link if you prefer to read the steps first.

REST equivalent: POST https://api.getfondoo.com/v1/ops/connect_wordpress_com with Authorization: Bearer <your Fondoo key> and {"siteId":"<site UUID>"}, then POST /v1/ops/test_connection and POST /v1/ops/connect_cms.

Test that it works

  1. test_connection reads /users/me?context=edit on your site. Status connected means the token works. Write actions stay "unknown" until used.
  2. Ask your agent to list your recent posts, then to create a draft. Check Posts → Drafts in WordPress.com.

Troubleshooting

  • "OAuth state expired or used". The 15-minute link timed out or was already used. Start again with connect_wordpress_com.
  • "WordPress.com did not authorize a site". The approval did not include a specific site. Run the flow again and pick the site.
  • Status invalid or "Provider request failed (401)" after a while. The token may have expired or been disconnected. WordPress.com's docs are not consistent about token lifetime. Reconnect with connect_wordpress_com, then delete the old connection.
  • "Provider request failed (403)". Your WordPress.com user lacks the role for that action, or your plan does not allow it.
  • Requests fail on a site with plugins. See "Sites with plugins" above.
  • "Connector rate budget exhausted". Fondoo allows about 60 actions per minute per connection.

Limits, data and security

  • What Fondoo stores: the access token and WordPress.com site ID (both encrypted), status, last test and last use, plus snapshots of pages it publishes (for undo). list_connections shows both fields as [redacted].
  • Rotate: run connect_wordpress_com again to get a fresh token, run connect_cms with the new connection, then delete the old connection.
  • Disconnect: delete_connection({connectionId}) removes the token from Fondoo. Agents need your approval. Also revoke Fondoo in WordPress.com: go to https://my.wordpress.com/me/security → Connected applications → ⋮ → Disconnect (third-party applications).