MCP 0.4.2 / Connections
User MCP connections with OAuth
Connect an individual WordPress account through OAuth 2.1 and PKCE.
User connections require MCP Pro and the User MCP connections switch. When disabled, discovery, consent, token, user endpoints, and connected-app surfaces are not published.
Open Account Security → Connected MCP apps or publish [cointacted_mcp_connected_apps] on a signed-in account page. Copy the displayed server URL into a compatible client and complete authorization code flow with PKCE S256.
Redirect URIs require exact matching. Access tokens last 15 minutes and refresh tokens rotate on use. Disconnecting an app revokes that client immediately.
Approve the minimum scopes and test one read call before any execute scope. Anonymous clients and administrator credentials are not valid substitutes for a user connection.