Plugin 7.2: connect by browser sign-in

Hi,

A new Respira for WordPress plugin release is now available: v7.2.0.

What is included in this release:

• Connect by browser sign-in (OAuth 2.0). Claude Desktop, claude.ai, Claude Code, ChatGPT (Developer Mode), Cursor, and Codex can now add your site as a custom connector by URL. The app discovers respira.press as the authorization server, you approve access once in the browser, and a site-scoped token is minted. Nothing to paste, nothing to download. The existing API-key, connect-by-link, and .mcpb paths are unchanged and keep working exactly as before.
• The native /mcp endpoint now advertises OAuth discovery per the MCP 2025-06-18 authorization spec: it serves /.well-known/oauth-protected-resource (RFC 9728) and its 401 carries a WWW-Authenticate: Bearer resource_metadata="..." pointer so OAuth-native clients can start the flow. Existing key-based clients ignore the extra header. The authorization server (registration, authorize and consent, token, revoke) lives at respira.press.
• New "Connect by browser sign-in" panel on the Setup screen, showing your site's MCP URL and step-by-step instructions, with a copy-paste starter prompt. A new Connected apps page in the respira.press dashboard lists every app you connected this way and lets you disconnect one in a click.
• OAuth access tokens are bound to a single site (RFC 8707) and validated by introspection at respira.press: a token issued for one site is rejected on every other site. Tokens are short-lived, refresh on rotation with reuse detection, stored only as hashes, and are revocable from the dashboard. The remote endpoint can be turned off entirely with the respira_mcp_remote_enabled filter.

We strongly encourage updating to stay aligned with the latest fixes and improvements.

Update/download: https://www.respira.press/dashboard/downloads

If you want help planning the update rollout across client sites, reply and we can assist.

Best, Mihai