Browser Sign In

Browser Sign-In

The Application Passwords "authorize application" flow (WordPress 5.6+) lets the user approve your app on their own site. WordPress then redirects back with a freshly created application password, so your app never asks for or sees the account password.

await client.discover();
final flow = AppPasswordFlow.fromDiscovery(
  client.discovery,
  appName: 'My App',
  successUrl: Uri.parse('myapp://wp-callback'),    // https URL or a custom scheme your app handles
  rejectUrl: Uri.parse('myapp://wp-rejected'),
);

await launchUrl(flow.authorizeUrl);                // open the system browser (url_launcher)

// When the redirect arrives (app link / custom scheme handler):
switch (flow.parseCallback(callbackUri)) {
  case final AppPasswordGranted granted:
    client.reconfigure(
      bootstrapper: (b) => b.withDefaultAuthorization(granted.toAuthorization()).build(),
    );
    // store granted.userLogin / granted.password in secure storage
  case AppPasswordRejected():
    print('The user declined');
}

• fromDiscovery throws a StateError when the site does not advertise application passwords; AppPasswordFlow(authorizationEndpoint: ...) builds one by hand.
• A random state is added to both redirect URLs and verified by parseCallback, which throws a FormatException for a callback that did not come from this flow or points to another site.
• appId (a UUID) groups the passwords of your app on the user's profile page. Pass a fixed one to keep it stable across installs.
• WordPress only offers application passwords on HTTPS sites (and local development environments).

Steps

1. Register a redirect target in your app: a custom URL scheme (myapp://wp-callback), an Android App Link or an iOS Universal Link. Plain https URLs work for web apps.
2. Create the flow from discovery (client.discover() caches it) and open flow.authorizeUrl in the system browser. Do not use an embedded web view: the user must be able to trust the page.
3. On the redirect, hand the full URI to flow.parseCallback. It returns AppPasswordGranted (with userLogin, password, siteUrl) or AppPasswordRejected.
4. Store the password in secure storage (Integration with Storage Packages) and configure the client with granted.toAuthorization().

Failure cases

Situation	What happens
Site has no application passwords (disabled, old WordPress, plugin)	fromDiscovery throws a StateError. Check AppPasswordFlow.discoverEndpoint(discovery) != null first
Callback with a wrong or missing state, or from another site	parseCallback throws a FormatException
User declines	AppPasswordRejected

See Authorization for the other auth methods.