Connecting WordPress to memberarea

Connecting is two steps that are easy to confuse. The API key lets your WordPress server read your products and courses. Member login is a separate switch that lets your visitors sign in with their memberarea account. The key alone does not enable sign-in.

Create an API key

1. In your memberarea, open Settings, then API.
2. Press New API key and name the key something you will recognize later, for example "WordPress".
3. A new key starts with full access, and the dialog says so. Press Limit to specific permissions: that clears every permission at once.
4. Open the group WordPress and tick View, plus Manage if members should be able to sign in on your site.
5. Press Create, then copy the key from Your new API key. It is shown once.

View covers everything the plugin displays: products with prices, courses with their offers, badges and group names. Manage covers registering your site for member sign-in. Neither permission can read orders or member data.

A key limited this way is the safer choice. If it ever leaks, it exposes no orders and no personal data. It also keeps the lists in the editor to what you actually sell: products set to hidden and hidden courses stay out of them. A key with full access lists those too.

Enter the connection in WordPress

1. In WordPress, open Settings, then MemberArea.
2. Under MemberArea domain, enter the address of your memberarea, host only: yourname.memberarea.io, without https:// and without a path. If you connected your own domain to your memberarea, you can enter that one instead. Members then sign in through it. If you paste a full address, the plugin keeps only the host. If it cannot find one, it keeps the previous domain and shows "That does not look like a valid domain. Enter the host only, for example yourname.memberarea.io."
3. Paste the key into API key and press Save Changes.

The key is stored on your WordPress server and is only ever sent from there to your memberarea. It never reaches a visitor's browser. After saving, the field shows the last four characters only, so you can tell one key from another without exposing it. To replace the key, paste a new one; to delete it, tick Remove the stored key and save.

Press Check connection whenever you saved a new key or a new domain. Saving clears the old finding on the Status panel but checks nothing by itself. The check sends one request and reports which business answered and which key it used, for example "Connected to Your Academy (yourname.memberarea.io). Key in use: WordPress."

• If the key belongs to a business whose addresses do not include the domain you entered, the same message turns yellow and adds "This key belongs to …, whose MemberArea address is …". Use a key from the right business, or enter the address it names as the domain.
• If it reports "The API key was rejected. It may have been replaced or removed.", create a new key and paste it in.

Switch on member login

Further down the same screen you will find Member login. It needs a key with the Manage permission.

1. Decide about the email address before you press the button: the checkbox Also share the member email address with this site sits next to it, and it is part of setting login up. Leave it off unless something on your site really needs the address.
2. Press Set up member login.

This registers your site with your memberarea and stores a shared secret on your server. The screen then shows:

• Return address and Sign-in address, the two URLs the flow uses.
• Email address, which now reads either "Shared with this site after the member agrees." or "Never shared with this site." It is read-only from here on. To change it, switch member login off and set it up again.
• Signing out here also signs the member out of the MemberArea, off by default. Tick it and press Save sign-out behaviour. With it on, signing out on WordPress takes the member to the memberarea to finish signing out, and they stay there.

Members sign in with the account they already have. No WordPress user account is created for them, and your WordPress user list stays untouched.

When something changes

If you change your WordPress site address or the memberarea domain, sign-in stops working. The Member login section then says that the domain or the site address changed and offers Set up member login again. Setting it up replaces the old connection, and the plugin revokes the old one in your memberarea. Members keep their memberships. After a new site address, they approve the connection once more on their next sign-in.

Moving the site to a different business in your memberarea? Press Switch member login off first, while the old domain and key are still saved. Otherwise the old connection stays active in the old business.

Switch member login off removes the stored secret, signs members out of your WordPress site, and deletes the connection in your memberarea together with every member's approval. They stay members, they just cannot sign in here any more. If you set login up again later, each member approves the connection once more on their next sign-in.