WU ACF APIs

WU ACF APIs is a WordPress plugin that exposes REST API endpoints for a Chrome extension and dashboard client. It supports user authentication, password reset requests, magic login links, logout, and authenticated access to selected ACF user fields.

Requirements

• WordPress 6.0 or newer
• PHP 7.4 or newer
• Advanced Custom Fields
• A JWT implementation that provides Firebase\JWT\JWT
• JWT_AUTH_SECRET_KEY defined in WordPress configuration

REST Namespace

All endpoints are registered under:

/wp-json/wu-acf/v1

Endpoints

Login

POST /wp-json/wu-acf/v1/login

Request body:

{
  "username": "user@example.com",
  "password": "password"
}

Successful response:

{
  "success": true,
  "token": "jwt-token",
  "user": {
    "id": 123,
    "email": "user@example.com",
    "name": "User Name"
  }
}

Logout

POST /wp-json/wu-acf/v1/logout

Requires an authenticated WordPress REST request. The client should remove the stored JWT after a successful logout response.

Lost Password

POST /wp-json/wu-acf/v1/lost-password

Request body:

{
  "user_login": "user@example.com"
}

Sends WordPress' standard password reset email for the matching username or email address.

Send Magic Login Link

POST /wp-json/wu-acf/v1/send-login-link

Request body:

{
  "email": "user@example.com"
}

Sends a one-time magic login link to the user's email address. The link expires after 15 minutes. When opened, the plugin logs in the user, generates a JWT, posts the token payload to the browser window for the Chrome extension, and redirects to the configured dashboard URL. The plugin uses https://dashboard.example.com as an example placeholder URL.

Current User ACF Data

GET /wp-json/wu-acf/v1/user-acf

Requires an authenticated WordPress REST request. The response is an array of dashboard data sections:

• status_store
• marketplaces
• sales_overview
• active_alerts

The plugin reads user-scoped ACF fields from user_{USER_ID} and reads action request details from the ACF options field action_requests_list.

ACF Fields Used

User fields:

• status_store
• amazon_active
• walmart_active
• walmart_plus_active
• prime_active
• ebay_active
• sales_overview
• active_alerts

Options fields:

• action_requests_list

CORS

The plugin sends REST CORS headers for the site origin, the example dashboard origin https://dashboard.example.com, and Chrome extension origins in this format:

chrome-extension://abcdefghijklmnopqrstuvwxyzabcdef

Additional allowed origins can be added with:

add_filter('wu_acf_apis_allowed_cors_origins', function ($origins) {
    $origins[] = 'https://example.com';
    return $origins;
});

Security Notes

• Magic login tokens are stored in user meta, expire after 15 minutes, and are deleted after successful use.
• JWT responses require JWT_AUTH_SECRET_KEY to be configured.
• The user ACF endpoint only returns data for the currently authenticated user.