WP Instorier Story Embed

WordPress plugin that lets editors search for an Instorier story in Gutenberg and render it on the frontend with Instorier SSR plus the required inline player script.

Public plugin interfaces

• Block: instorier/story-embed
• REST route: GET /wp-json/instorier-story-embed/v1/stories?search=...
• Options:
  • instorier_story_embed_site_id
  • instorier_story_embed_api_key

Features

• Settings page under Settings > Instorier Story Embed
• Server-only storage for the Instorier API key
• Editor search proxy restricted to users who can edit_posts
• Dynamic block rendering with native Gutenberg alignment support
• Frontend SSR-first rendering with script-only fallback on failure
• Request dedupe and transient caching
  • Manifest cache: 300s
  • SSR cache: 120s

Permissions and data exposure

• The API key never leaves the server and is not exposed to the block editor.
• The editor receives only the configured siteId.
• The REST search endpoint is restricted by permission_callback and returns 403 to users who cannot edit posts.

Service usage

• This plugin requires an Instorier account with an active Newsroom subscription, plus a valid Site ID and API key.
• When configured, it communicates with stories.instorier-cdn.com to fetch route manifests, SSR payloads, and the Instorier player runtime for selected stories.
• Review the Instorier service terms and privacy policy before deployment:
  • Terms: https://instorier.com/terms-and-conditions
  • Privacy: https://instorier.com/privacy-policy

Configuration precedence

Credential resolution uses this order:

1. instorier_story_embed_site_id / instorier_story_embed_api_key filters
2. INSTORIER_STORY_EMBED_SITE_ID / INSTORIER_STORY_EMBED_API_KEY constants
3. Saved wp-admin settings in instorier_story_embed_site_id / instorier_story_embed_api_key

Filters are override-only. Return an empty string to fall back to the constant or saved setting.

VIP-friendly configuration

For VIP or other code-managed environments, prefer setting credentials in code instead of wp-admin.

Example using wp-config.php constants:

define( 'INSTORIER_STORY_EMBED_SITE_ID', '111111' );
define( 'INSTORIER_STORY_EMBED_API_KEY', 'your-secret-token' );

Example using filters:

add_filter(
    'instorier_story_embed_site_id',
    static function () {
        return '111111';
    }
);

add_filter(
    'instorier_story_embed_api_key',
    static function () {
        return getenv( 'INSTORIER_API_KEY' ) ?: '';
    }
);

When code-based configuration is active, the settings page stays available but overridden fields become read-only and saved values are treated as fallback only.

SSR trust model

The plugin keeps Instorier SSR enabled on the frontend, but hardens the integration boundary:

• Outbound requests are restricted to explicit Instorier host and path allowlists.
• Manifest and SSR responses must decode as JSON and have an expected shape.
• SSR fragments are rejected if they contain obvious script execution primitives such as:
  • `