WordPress

Keva connects to WordPress in two ways, depending on how much you want it to do. Both are token-scoped and revocable from your WordPress admin.

One plugin issues both tokens. Install it once, then use the connector token for content updates and add the Bridge token to unlock the full connection.

Install the Keva plugin (recommended)

1. Download the plugin: keva-latest.zip (GPLv2, tested on WordPress 7.0)
2. In WordPress admin, go to Plugins → Add New → Upload Plugin and select the zip
3. Click Install Now, then Activate Plugin — activation generates both tokens
4. Open Keva → Status in the WordPress admin at any time to view or regenerate the connector token and Bridge token

Connect for content updates

1. In Keva, go to Integrations → WordPress Sites → Add site
2. Paste the site URL and the connector token

Connect the full connection (page builders + operational support)

1. In Keva, go to Integrations → Platform Connectors → Add platform and pick WordPress
2. Paste your site URL and the Bridge token from Keva → Status — that is the whole connection. Optionally add a WordPress username + Application Password to also enable WordPress-account actions (users, comments, media).

Application Passwords (no plugin)

For sites you fully own where install friction matters, you can use WordPress's built-in Application Passwords instead of the connector token. This covers content updates only.

1. In Keva, go to Integrations → Platform Connectors → Add platform and pick WordPress
2. In WordPress admin, go to Users → Your Profile → Application Passwords
3. Generate a password named "Keva", copy it (spaces are OK), then enter your WordPress username and the password in Keva

The Application Password inherits the WordPress user's full role, so use a dedicated editor or admin account.

Optional hardening (per-site, in wp-config.php)

// Only accept connections from Keva's egress IPs (IPv4 exact or CIDR).
// Contact support@keva.support for current IPs — they're per-deployment.
define( 'KEVA_CONNECTOR_ALLOWED_IPS', [ '203.0.113.0/24' ] ); // content / connector token
define( 'KEVA_BRIDGE_ALLOWED_IPS',    [ '203.0.113.0/24' ] ); // full / Bridge token
 
// Only enable behind a reverse proxy that strips client-set X-Forwarded-For.
define( 'KEVA_CONNECTOR_TRUST_FORWARDED_FOR', true );
define( 'KEVA_BRIDGE_TRUST_FORWARDED_FOR', true );

Requirements

• WordPress 6.0+ (5.6+ for the Application Password path)
• REST API enabled (default in all modern WordPress installs)
• HTTPS in production — enforced by the plugin; the Application Password path is HTTPS-only by Keva policy
• Tested up to WordPress 7.0 with PHP 8.4

Available actions

The Users, Media, Plugins & Themes, and Comments tables below (and plain post CRUD) use WordPress's standard REST API, which requires the optional username + Application Password on the connector. Page-builder editing and the operational categories (diagnostics, backups, updates, security, performance, SEO, ACF, multilingual, WooCommerce) run on the Bridge token alone.

Posts & Pages

Users

Media

Plugins & Themes

Comments

Use Cases

Content Request

Customer: "Can you update the pricing on our services page?"

AI:
1. Calls list_pages() to find Services
2. Calls get_page(123) for current content
3. Reports current pricing text
4. Updates if customer confirms changes

User Access

Customer: "John left the company, remove his access"

AI:
1. Calls list_users() to find John
2. Confirms user: john@company.com
3. Calls delete_user(45)
4. Reports: "User removed successfully"

Plugin Issue

Customer: "Site is showing errors after plugin update"

AI:
1. Calls list_plugins() for recently updated
2. Identifies problematic plugin
3. Calls deactivate_plugin(plugin-slug)
4. Reports: "Disabled Contact Form 7"

Configuration

• Site URL: Your WordPress installation URL
• Content write: Enable/disable post/page editing
• User management: Enable/disable user operations
• Plugin control: Enable/disable plugin activation
• Media upload: Allow media library access