Code Samples #
Copy
curl --request POST \
--url 'https://app.xcloud.host/api/v1/sites/{uuid}/magic-login' \
--header 'Authorization: Bearer YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
"login_as": "editor_user"
}'
const response = await fetch('https://app.xcloud.host/api/v1/sites/{uuid}/magic-login', {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_TOKEN',
'Content-Type': 'application/json'
},
body: JSON.stringify({
"login_as": "editor_user"
})
});
const data = await response.json();
console.log(data);
import requests
headers = {
"Authorization": "Bearer YOUR_TOKEN",
"Content-Type": "application/json"
}
payload = {
"login_as": "editor_user"
}
response = requests.post("https://app.xcloud.host/api/v1/sites/{uuid}/magic-login", headers=headers, json=payload)
print(response.json())
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => 'https://app.xcloud.host/api/v1/sites/{uuid}/magic-login',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => [
'Authorization: Bearer YOUR_TOKEN',
'Content-Type: application/json'
],
CURLOPT_POSTFIELDS => '{
"login_as": "editor_user"
}',
]);
$response = curl_exec($curl);
curl_close($curl);
echo $response;
using System.Net.Http;
using System.Text;
var client = new HttpClient();
var request = new HttpRequestMessage(new HttpMethod("POST"), "https://app.xcloud.host/api/v1/sites/{uuid}/magic-login");
request.Headers.Add("Authorization", "Bearer YOUR_TOKEN");
request.Content = new StringContent(@"{
""login_as"": ""editor_user""
}", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);
import java.net.URI;
import java.net.http.*;
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://app.xcloud.host/api/v1/sites/{uuid}/magic-login"))
.header("Authorization", "Bearer YOUR_TOKEN")
.header("Content-Type", "application/json")
.method("POST", HttpRequest.BodyPublishers.ofString("""
{
"login_as": "editor_user"
}
"""))
.build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
Response #
Copy
{
"success": true,
"message": "Magic login URL generated",
"data": {
"url": "https://example.com/wp-admin/wp-login.php?xcloud_magic_login_token=eyJ...&auth_token=Xa3p9q&v=1742212211",
"expires_at": "2026-05-20T14:50:00Z",
"admin_user": "admin"
}
}
{
"success": false,
"message": "Unauthenticated.",
"data": null
}
{
"success": false,
"message": "An error occurred.",
"data": null
}
{
"success": false,
"message": "Not found.",
"data": null
}
{
"success": false,
"message": "An error occurred.",
"data": null
}
{
"success": false,
"message": "An error occurred.",
"data": null
}
{
"success": false,
"message": "An error occurred.",
"data": null
}
{
"success": false,
"message": "An error occurred.",
"data": null
}
Returns a short-lived URL that logs the WordPress admin into the site’s /wp-admin dashboard without a password. Token TTL is 10 minutes. Synchronous — the first call uploads the xCloud magic-login WP plugin over SSH (subsequent calls skip when plugin status is healthy).
Rate-limited to 30 requests per minute per user. Requires the write:sites scope and the site:magic-login permission. Delegated logins (login_as) additionally require the site:access-magic-login Team permission.
Path Parameters #
| Name | Type | Required | Description |
|---|---|---|---|
uuid | string (uuid) | Required | UUID of the site |
Request Body #
Content type: application/json
| Field | Type | Required | Description |
|---|---|---|---|
login_as | string | Optional | Optional WordPress username to log in as. When omitted, logs in as the site's admin user. Requires the caller's Team membership to grant the `site:access-magic-login` permission. |
Example request
Copy
{
"login_as": "editor_user"
}
Responses #
200 — Magic login URL generated #
| Field | Type | Required | Description |
|---|---|---|---|
success | boolean | Optional | |
message | string | Optional | |
data | object | Optional | |
data | object | Optional | |
data.url | string (uri) | Optional | Short-lived URL that logs the WordPress admin in without a password. Open in a browser to land on /wp-admin. Valid for 10 minutes from creation. |
data.expires_at | string (date-time) | Optional | ISO 8601 timestamp at which the URL stops being valid. |
data.admin_user | string | Optional | WordPress username that the URL will log in as. Equals the site's admin user unless `login_as` was passed. |
Example 200 response
Copy
{
"success": true,
"message": "Magic login URL generated",
"data": {
"url": "https://example.com/wp-admin/wp-login.php?xcloud_magic_login_token=eyJ...&auth_token=Xa3p9q&v=1742212211",
"expires_at": "2026-05-20T14:50:00Z",
"admin_user": "admin"
}
}
401 — Missing or invalid authentication token #
| Field | Type | Required | Description |
|---|---|---|---|
success | boolean | Optional | |
message | string | Optional | |
data | object | Optional |
Example 401 response
Copy
{
"success": false,
"message": "Unauthenticated.",
"data": null
}
403 — Forbidden — caller lacks site:magic-login or delegation permission #
| Field | Type | Required | Description |
|---|---|---|---|
success | boolean | Optional | |
message | string | Optional | |
data | object | Optional |
Example 403 response
Copy
{
"success": false,
"message": "An error occurred.",
"data": null
}
404 — Resource not found or not accessible to your Team #
| Field | Type | Required | Description |
|---|---|---|---|
success | boolean | Optional | |
message | string | Optional | |
data | object | Optional |
Example 404 response
Copy
{
"success": false,
"message": "Not found.",
"data": null
}
422 — Site is not WordPress, or magic login is disabled on the Server #
| Field | Type | Required | Description |
|---|---|---|---|
success | boolean | Optional | |
message | string | Optional | |
data | object | Optional |
Example 422 response
Copy
{
"success": false,
"message": "An error occurred.",
"data": null
}
429 — Rate limit exceeded (30/min/user) #
| Field | Type | Required | Description |
|---|---|---|---|
success | boolean | Optional | |
message | string | Optional | |
data | object | Optional |
Example 429 response
Copy
{
"success": false,
"message": "An error occurred.",
"data": null
}
502 — Failed to provision magic login plugin on the site #
| Field | Type | Required | Description |
|---|---|---|---|
success | boolean | Optional | |
message | string | Optional | |
data | object | Optional |
Example 502 response
Copy
{
"success": false,
"message": "An error occurred.",
"data": null
}
503 — Server is not connected #
| Field | Type | Required | Description |
|---|---|---|---|
success | boolean | Optional | |
message | string | Optional | |
data | object | Optional |
Example 503 response
Copy
{
"success": false,
"message": "An error occurred.",
"data": null
}
