Identity
Connect an agent with the wizard
The wizard exists so the credential is created deliberately, shown once, and tied to an identity that already has a purpose written down.
- Agents & identity
- 4 min read
The flow
- Open the agent and start the Connection Wizard.
- Choose the dedicated least-privilege WordPress user. The wizard shows you that user’s role, because it is about to become the agent’s ceiling.
- Generate the Application Password. It is revealed once.
- Copy it into the agent’s configuration before leaving the screen.
- Run the connection health test.
Revealed once, and only once
There is no way to display the secret again — that is a property of WordPress Application Passwords, not a limitation we added. If you lose it, do not create a second agent. Rotate the credential on the existing identity, which keeps its history and its permissions.
Not in a support email, not in a public forum post, not committed to a repository, and not in a shared document. Treat it as you would a database password.
Connection health tests
A health test confirms the credential authenticates and resolves to this agent. Run one after connecting, after any rotation, and first whenever an agent stops being recognised.
A healthy connection does not mean the agent can do anything yet. It means the identity gate will pass; everything downstream is still default deny.
Suspend, rotate, revoke
| Action | Effect | Use when |
|---|---|---|
| Suspend | The connection stops resolving. The agent and its history stay. | You want to pause access while you investigate. |
| Rotate | A new secret is issued; the old one stops working immediately. | Routine hygiene, or a credential you think may have leaked. |
| Revoke | Credentials are invalidated and sessions terminated connection-wide. | The agent should not act again. |
In every case credentials are invalidated before the connection state changes, so there is no window in which an in-flight session outlives the change.
Agents & identity
Keep the boundary while you fix the problem.
A good fix restores intended behaviour without creating a second path around WordPress or the governed request lifecycle.