Data from APIs and static JSON

Two pieces#

• An API connection holds a base URL and how to sign in. It’s set up once in Settings → Data & APIs, and its secrets are encrypted.
• A data source is one request (or static data) your pages use. It’s made in the builder’s Data tab, and names a connection — it never holds credentials itself.

Connections#

Authentication can be none, an API key (in a header or the query string), a bearer token, basic auth, extra headers, OAuth 2 client credentials (the token is fetched and kept until it expires), or OAuth 2 sign-in. Secrets are encrypted per field and never shown again after saving; the builder, your pages and the AI only ever see names and base URLs.

Create a data source#

1. Open the Data tabIn the builder’s left column, open Data and create a source.
2. Describe the requestA connection (or a full public URL), the method, a path with :params, query parameters, headers and a body. Values can include dynamic data — /weather?city={custom_field:city} — which is URL-encoded, so data can change a parameter but never the host or the path’s structure.
3. Set caching and paginationHow long responses are cached (up to 7 days), where the records are in the response (data.results), and how pages work: page numbers, offset and limit, cursor, or a next-page link.
4. Send a test requestSend request runs it in WordPress and shows the status, time and size, the response as a tree, the raw text, what was sent (with secrets masked), the lists found and the fields of a record with their types.

Pick the records list and copy any field as a token straight from the tree. Static data — JSON up to 256 KB — works the same way without a request.

Use the data#

• A Query Loop, Data Table or Chart set to show data from the source.
• {api:@source.path} in any text on a page, and {item:path} inside a loop.
• Lists inside a record (a property’s photos, a team’s players) in nested loops, to any depth.
• Filter, sort and paginate records — by the API when it paginates (Load more asks it for the next page), otherwise in WordPress.

Reliability and safety#

• Requests always run in WordPress, never in the visitor’s browser.
• Responses are cached per request. The last good response is kept for a week, so a failing API still shows its last data; failures are cached briefly so a broken API isn’t called on every view.
• Each source is rate-limited — Settings → Data & APIs → Requests per minute, per data source (60 by default) — and responses over Largest response (2,048 KB by default) are refused.
• Private and local network addresses are refused, redirects included.
• Errors are named — timeout, blocked, authentication, not found, rate limited, server error, invalid JSON, too large — in the inspector and in the loop’s Error State.
• Refresh a source or clear its cache from the Data tab or Settings → Data & APIs, which also shows when each was last fetched.