How to Integrate Retool with WordPress

Application Passwords (introduced in WordPress 5.6) let you generate per-application credentials that authenticate with the WordPress REST API without using your main admin password. In your WordPress admin panel, go to Users → Profile (or Users → All Users → click your username → Edit). Scroll down to the Application Passwords section near the bottom of the profile page. If you do not see this section, your WordPress installation may have it disabled by a security plugin (some plugins like Wordfence block Application Passwords by default) — check your security plugin settings. In the Add New Application Password section, enter a descriptive name in the Name field, such as Retool Integration. Click Add New Application Password. WordPress generates and displays a password in the format XXXX XXXX XXXX XXXX XXXX XXXX (24 characters with spaces). Copy this password immediately — it is only shown once. Save it in a secure location. This Application Password is used for HTTP Basic Auth: the username is your WordPress admin username (not the email address), and the password is the Application Password you just generated, including the spaces. Note that the Application Password grants the same permissions as the user account you generated it from — use an admin account for full REST API access, or a more restricted role if you only need read access.

In Retool, go to the Resources tab and click Add Resource. Select REST API from the resource type list. Give the resource a name like WordPress Production or your site name + CMS (e.g., Acme Blog CMS). In the Base URL field, enter your WordPress site's REST API base URL: https://yoursite.com/wp-json/wp/v2. Include the /wp-json/wp/v2 path prefix — this means all query paths in Retool will be relative to this base, so a query for posts would use path /posts rather than the full URL. In the Authentication section, select Basic Auth. Enter your WordPress admin username in the Username field — this is the username you log in with, not the email address. In the Password field, enter the Application Password you generated, including the spaces (e.g., Ab12 Cd34 Ef56 Gh78 Ij90 Kl12). WordPress accepts Application Passwords with or without spaces. Click Save. To verify the connection, create a test query targeting /posts with method GET and run it — you should receive a JSON array of posts. If you receive a 401 error, double-check the username and Application Password. If you receive a 403 error, the user account may not have the required role for the operation.

Create a new query, select your WordPress resource, set Method to GET, and set Path to /posts. WordPress's posts endpoint supports extensive query parameters for filtering: per_page (up to 100), page (for pagination), status (publish, draft, pending, private — or any for all), author (user ID), categories (comma-separated category IDs), search (keyword search), orderby (date, title, modified, relevance), and order (asc or desc). Add these as URL Parameters in the query editor, referencing Retool component values using {{ }} syntax. For example, add a status parameter with value {{ statusFilter.value || 'any' }} to filter by status from a Select component. Set per_page to {{ perPageSelect.value || 100 }}. WordPress also supports the _fields parameter to restrict which fields are returned — add _fields with value id,title,status,date,modified,author,categories,excerpt,link,slug to avoid fetching full post content for list views, significantly reducing response size. Run the query. WordPress returns an array of post objects with nested objects for title (rendered), excerpt (rendered), and content (rendered) — each has a .rendered sub-field containing the actual HTML or text. Apply a transformer to flatten these nested objects before binding to Table.

1// WordPress posts transformer — flatten nested title/excerpt objects
2// Paste into Advanced → Transform results
3const posts = data || [];
4return posts.map(post => ({
5  id: post.id,
6  title: post.title?.rendered || '(no title)',
7  slug: post.slug || '',
8  status: post.status || '',
9  date: post.date ? new Date(post.date).toLocaleDateString() : '',
10  modified: post.modified ? new Date(post.modified).toLocaleDateString() : '',
11  author_id: post.author || '',
12  excerpt: post.excerpt?.rendered
13    // Strip HTML tags from excerpt
14    ? post.excerpt.rendered.replace(/<[^>]*>/g, '').trim()
15    : '',
16  // Direct link to WordPress editor for this post
17  edit_link: `${post.link.replace(/\/[^\/]*$/, '')}/wp-admin/post.php?post=${post.id}&action=edit`,
18  view_link: post.link || ''
19}));

Create an update query to change post fields. Select your WordPress resource, set Method to POST (WordPress uses POST for updates to existing resources, not PATCH), Path to /posts/{{ table1.selectedRow.id }}, and Body type to JSON. In the Body field, enter a JSON object with the fields to update. For a status change: { status: {{ statusUpdateSelect.value }} }. For a title and excerpt update: { title: {{ titleInput.value }}, excerpt: {{ excerptInput.value }} }. WordPress validates the status value against allowed values (draft, pending, publish, future, private) and returns the updated post object on success. Wire this query to a Save Changes button. For bulk status updates across multiple selected rows, use a JavaScript query that iterates over table1.selectedRows (an array of all checked rows when multi-select is enabled) and calls the update query for each. Enable multi-select on the Table by toggling the Selection Type to Multiple in the Table settings. Add a Publish Selected button that triggers the JavaScript bulk update with status: 'publish'. On success, refresh the posts query and show a notification with the count of updated posts. For updating custom fields stored as post meta, include the meta object in the request body: { meta: { _yoast_wpseo_metadesc: {{ metaDescInput.value }} } }. Note that custom meta fields must be registered with register_meta() and exposed via the REST API to be writable.

1// JavaScript query for bulk status update of selected posts
2// Triggered by a 'Publish Selected' button onClick
3const selectedPosts = table1.selectedRows;
4if (!selectedPosts || selectedPosts.length === 0) {
5  utils.showNotification({ title: 'No posts selected', notificationType: 'warning' });
6  return;
7}
8
9const targetStatus = bulkStatusSelect.value || 'publish';
10
11const updatePromises = selectedPosts.map(post =>
12  updatePostStatus.trigger({
13    additionalScope: {
14      postId: post.id,
15      newStatus: targetStatus
16    }
17  })
18);
19
20try {
21  await Promise.all(updatePromises);
22  await getPosts.trigger();
23  utils.showNotification({
24    title: `Updated ${selectedPosts.length} posts to ${targetStatus}`,
25    notificationType: 'success'
26  });
27} catch (err) {
28  utils.showNotification({
29    title: 'Some updates failed: ' + err.message,
30    notificationType: 'error'
31  });
32}

Extend the WordPress panel with user management and media library capabilities. For users, create a query with Path /users and Method GET. Add query parameters: per_page 100, context edit (required to see email addresses and capabilities, requires authentication), and roles to filter by role (administrator, editor, author, subscriber). Apply a transformer to extract the relevant user fields. Create an update query targeting /users/{{ table1_users.selectedRow.id }} to change user roles: { roles: [{{ roleSelect.value }}] }. For the media library, create a query with Path /media and GET method. Add mime_type as a query parameter to filter by file type (image/jpeg, image/png, application/pdf). The response includes source_url for the full-size file, media_details.sizes for different size variants, title.rendered for the filename, and alt_text. Display media items in a Retool Image Mosaic or Table component with clickable links to the source URLs. For creating new media (uploading files), this requires multipart form data upload which is best handled directly in WordPress — Retool's REST API resource can send binary data, but file upload UI is typically simpler in WordPress's native media uploader. For RapidDev's team building complex WordPress editorial workflows combining multiple endpoints, custom fields, and multi-site configurations, RapidDev can architect the full Retool solution.

1// WordPress users transformer
2const users = data || [];
3return users.map(user => ({
4  id: user.id,
5  username: user.slug || '',
6  name: user.name || '',
7  email: user.email || '(hidden)',
8  roles: Array.isArray(user.roles) ? user.roles.join(', ') : '',
9  registered: user.registered_date
10    ? new Date(user.registered_date).toLocaleDateString()
11    : '',
12  post_count: user.meta?.post_count || 0,
13  profile_url: user.link || ''
14}));