Free Features · RKX API Studio 1.0.0
Separate administration from API access
Endpoint administration requires WordPress administrator capabilities and REST nonces. An API key permits configured endpoint access; it does not sign in as a WordPress administrator. Restrict dashboard access and install plugins only from trusted sources.
Publish only intended data
Select minimal fields, audit custom meta and ACF values, and test every public route in a signed-out session. GET delivery excludes unpublished and password-protected posts. Key protection does not turn this into a private-content or per-user authorization system.
Use HTTPS and trusted clients
Serve your site over HTTPS and keep API and license keys in backend secrets. Review hosting logs, proxy caches and cross-origin policies. The plugin does not promise application-specific request quotas, identity-based permissions or automatic validation of your write-action business rules.
Related guides
Public endpoints, API keys and access control