Connect Claude Code and Codex to your WordPress site

Do I need an AI API key or separate billing?

Three different credentials get mixed up here. Only two of them are needed:

Claude Code on your Claude plan

Sign in with the account that holds your Pro or Max plan when Claude Code asks. If you set up Claude Code with an API key in the past, run claude logout, then claude login and pick your Claude account. If an ANTHROPIC_API_KEY environment variable is set on your computer, Claude Code uses it instead of your plan and bills that key, so remove it first. Your plan’s usage limits are shared between Claude and Claude Code; /status shows what’s left.

Codex on your ChatGPT plan

Run codex in a terminal and choose to sign in with ChatGPT. Usage then comes out of your ChatGPT plan, and limits depend on the plan. If Codex was set up with an API key before, run codex logout and sign in again with ChatGPT.

Before you start

1. Install and activate Royal MCP, then turn on Enable Royal MCP Integration in WP Admin → Royal MCP → Settings.
2. Copy your MCP Server URL from the same page. It looks like https://example.com/wp-json/royal-mcp/v1/mcp.
3. Choose how the client signs in to your site:
   • OAuth (recommended): a one-time approval screen in your browser. No key to copy or store.
   • API key: the WordPress API Key from Royal MCP → Settings. Use it for local sites and for hosts whose firewall blocks the OAuth sign-in.

Replace example.com in every command below with your own site address.

Claude Code

With OAuth (recommended)

claude mcp add --transport http royal-mcp https://example.com/wp-json/royal-mcp/v1/mcp

Start a Claude Code session. On the first Royal MCP call your browser opens the approval screen; click Authorize and the connection is saved for later sessions.

With an API key

claude mcp add --transport http royal-mcp https://example.com/wp-json/royal-mcp/v1/mcp \
    --header "Authorization: Bearer your-api-key-here"

Check the connection

Type /mcp inside a Claude Code session. Royal MCP should show as connected with its tool count. From a normal terminal, claude mcp list shows the same. The Claude Code VS Code and JetBrains extensions use the same connection.

For re-authenticating a stale connection and the other states /mcp can show, see the Claude Code section of the Claude guide.

Codex

With OAuth (recommended)

codex mcp add royal-mcp --url https://example.com/wp-json/royal-mcp/v1/mcp
codex mcp login royal-mcp

The login command opens the approval screen in your browser. Approve it once; Codex stores the token. Run codex mcp login royal-mcp again if the connection ever asks you to sign in.

With an API key

Codex reads the key from an environment variable, so the key never sits in a config file. Set the variable, then add the server:

# macOS and Linux (add the export line to your shell profile to keep it)
export ROYAL_MCP_API_KEY="your-api-key-here"

# Windows (PowerShell; open a new terminal afterwards)
setx ROYAL_MCP_API_KEY "your-api-key-here"

codex mcp add royal-mcp \
    --url https://example.com/wp-json/royal-mcp/v1/mcp \
    --bearer-token-env-var ROYAL_MCP_API_KEY

Check the connection

codex mcp list shows every server Codex knows about, and codex mcp get royal-mcp shows the details for this one. Inside a Codex session, /mcp lists the active servers.

The Codex CLI, the Codex IDE extension and the ChatGPT desktop app share this configuration, so one setup covers all three. ChatGPT in the browser does not read it; use the ChatGPT guide for that.

Local and staging sites

Claude Code and Codex run on your computer and connect to your site from there. That means they can work on a site in a local development tool or on a staging copy that isn’t open to the public, as long as the address opens in your own browser.

Claude and ChatGPT in the browser connect from Anthropic’s and OpenAI’s servers instead. They can only reach a site that is public and served over HTTPS.

Limit what the agent can touch

For every client at once: turn on Read-only mode in Royal MCP → Settings. Agents can read your site but every tool that creates, updates or deletes anything is refused.

In Claude Code: add deny rules to .claude/settings.json in your project. Royal MCP tools are named mcp__royal-mcp__ followed by the tool name:

{
  "permissions": {
    "deny": [
      "mcp__royal-mcp__wp_delete_post",
      "mcp__royal-mcp__wp_delete_page",
      "mcp__royal-mcp__wp_delete_media"
    ]
  }
}

In Codex: add enabled_tools (an allow list) or disabled_tools (a deny list) to the server entry in ~/.codex/config.toml:

[mcp_servers.royal-mcp]
url = "https://example.com/wp-json/royal-mcp/v1/mcp"
disabled_tools = ["wp_delete_post", "wp_delete_page", "wp_delete_media"]

With Royal MCP Pro: Custom Endpoint Profiles give each project its own endpoint that exposes only the tools you pick, whatever client connects to it.

Drafts, undo, revisions and what happens if you remove the plugin are covered in Safety and recovery for AI edits.

Related guides