@spacefast/wordpress

Private-beta, read-only access to WordPress content from a Spacefast site or any JavaScript app with fetch.

Set up a Spacefast site

1. In the Dashboard, open your space, go to Settings → Data sources, add a named public WordPress site, choose the default source, and save. The site must expose standard pretty-permalink REST URLs under /wp-json; Dashboard sources do not support ?rest_route=... URLs.
2. Connect the repository that builds the site to the same space.
3. Install the SDK in that repository:

npm install @spacefast/wordpress

4. Read content in build-time or SSR Node code. Omit url for the default source, or pass source to select another configured name:

import { createWordPressClient } from "@spacefast/wordpress";

const wp = createWordPressClient();
const { data: posts, pagination } = await wp.posts.list({
  perPage: 10,
  orderBy: "date",
});
const about = await wp.pages.bySlug("about");

const docs = createWordPressClient({ source: "docs" });

5. Commit the dependency and code, then start a new Spacefast repository build. Each build receives the Dashboard source configuration and fetches the current WordPress content.
6. Back in Settings → Data sources, choose Connect WordPress. Download the plugin and install it in WordPress. In Settings → Spacefast, choose Headless CMS, continue to Spacefast, authorize one Team, and select this Space. Public content changes wait for a 60-second quiet window before one production build starts; Build now remains immediate in both WordPress and the Spacefast Dashboard.

URL and environment rules

Zero-config discovery reads Node environment variables, so it only works during a build or in an SSR Node runtime. Browser code must pass an explicit url. Explicit URLs may be a WordPress site URL, a /wp-json or /wp-json/wp/v2 REST root, or a supported non-pretty form such as https://blog.example.com/index.php?rest_route=/.

An explicit SDK url always wins. With source, the client resolves only that named entry from SPACEFAST_DATA_SOURCES (or legacy SPACEFAST_DATASOURCES) and ignores WORDPRESS_URL. Without source, a non-blank WORDPRESS_URL wins; otherwise the payload's default entry is used. Spacefast preserves user-defined build variables instead of replacing them with Dashboard-generated values.

Private beta boundaries

• Read-only: the client only makes GET requests. It does not create, edit, or delete WordPress content.
• Public content only: there is no authentication, preview, draft, or private content support.
• Build snapshots: WordPress changes become visible only after a repository build succeeds. The optional Spacefast WordPress plugin starts that build automatically; without it, use Build now.
• Controlled authorization: the plugin uses OAuth 2 with PKCE. Access is bounded by the signed-in user's live Team role, the one Team approved on the consent screen, and the Headless CMS scopes. WordPress then selects one Space. The trigger derives the production repository, saved commands, and live target server-side; the plugin cannot upload arbitrary output or override a build. Disconnect revokes refresh access, and Connected Apps can revoke the Team grant immediately.
• Private beta: the API may change before the stable release.