Cosmobill Connector — WordPress plugin

Not sure you need this? Try connecting Cosmobill without it first — Settings → Integrations → WordPress, using a free WordPress Application Password. Only install this plugin if a paid invoice's linked post doesn't go live. That almost always means your host's firewall (very common on Cloudflare-protected sites) is silently blocking the connection, and this plugin routes around exactly that.

Install in 4 steps

On your WordPress site: Plugins → Add New → Upload Plugin → upload the zip above → Install Now → Activate.
After activation, open Settings → Cosmobill Connector. Copy the generated webhook URL and shared secret.
In Users → Profile, create an Application Password for an existing account that can publish the linked drafts. In Cosmobill: Settings → Integrations → WordPress, paste the webhook URL, secret, username, and Application Password, then save.

What it does — and doesn't do

It publishes a post you've already linked to an invoice, the moment that invoice is paid. Nothing else changes on your site.
It does not write, edit, or touch the content of any post. Cosmobill only ever sends a post ID; the plugin flips that one draft to published.
It does not read or transmit anything else about your site — no other posts, no user data, no settings.
It never creates or logs in to a WordPress user. Publishing uses the existing account and Application Password configured by the site administrator.

If you ever want to disconnect

Suspect the secret leaked, or just want to cut the connection? Go to Settings → Cosmobill Connector → Get a new secret on your WP site, then paste the new value into Cosmobill (or leave it blank to stop auto-publish entirely). The old secret stops working the instant you rotate — no uninstall needed.

Technical details, for the curious

Every publish request sends the existing WordPress Application Password through HTTP Basic Auth, plus the HMAC signature and body:

POST /wp-admin/admin-ajax.php?action=cosmobill_publish
Authorization: Basic <base64(username:application-password)>
X-Cosmobill-Signature: sha256=<HMAC>
Content-Type: application/json
{"post_id": 12345}

The endpoint runs on admin-ajax.php — not /wp-json/ — specifically because that's the same path the WordPress admin UI itself hits constantly, so it isn't on any WAF's REST-block list. WordPress core validates the Application Password and the plugin then checks the account's capabilities. The HMAC is SHA-256(secret, raw_request_body), hex-encoded, prefixed with sha256=. The plugin recomputes it on receipt and compares with hash_equals (constant-time), so requests must pass both authentication checks.

Security model:

The shared secret is 32 bytes from random_bytes, hex-encoded, generated automatically on activation.
The connector never creates users, generates passwords, or implements a custom login flow. WordPress core authenticates the administrator-configured Application Password.
The authenticated account must be able to edit the linked draft, and the connector rejects targets that are not drafts.
Rotating the secret (Settings → Cosmobill Connector → Get a new secret) invalidates the old one immediately.

Test the endpoint directly once it's configured:

curl -X POST 'https://yourblog.com/wp-admin/admin-ajax.php?action=cosmobill_publish' \\
  -u 'wordpress-username:application-password' \\
  -H 'Content-Type: application/json' \\
  -H 'X-Cosmobill-Signature: sha256=<hex-hmac-of-body-using-secret>' \\
  -d '{"post_id": 123}'

Compute the HMAC locally with openssl dgst -sha256 -hmac "<secret>".