WordPress

A small plugin whose shortcode signs the logged-in WordPress user and prints the editor iframe.

WordPress renders pages in PHP on the server, so a shortcode can sign the current user and output the iframe in one go. The secret lives in wp-config.php and never reaches the browser.

Before you start

Follow the first three steps of the quickstart: create a plugin, add your site's origin (for example https://example.com) to its allowed domains, and copy the Plugin ID and Secret.

Configuration

Add the keys to wp-config.php, above the line that says That's all, stop editing!:

wp-config.php

define('MAILEDITOR_PLUGIN_ID', '9f3c1e7a-4b21-4c8e-9a77-1d2f5b6c8e10');
define('MAILEDITOR_PLUGIN_SECRET', 'your_plugin_secret');

Sign and render

Create the file below, then activate MailEditor Embed under Plugins in the WordPress admin. The comment block at the top is required; WordPress reads it to recognise the plugin.

wp-content/plugins/maileditor-embed/maileditor-embed.php

<?php
/**
 * Plugin Name: MailEditor Embed
 * Description: Renders the MailEditor email editor for the logged-in user with the [maileditor] shortcode.
 */

add_shortcode('maileditor', function () {
    if (!is_user_logged_in()) {
        return '<p>Please sign in to open the email editor.</p>';
    }

    $user_id   = 'wp-user-' . get_current_user_id();
    $expires   = time() + 300;
    $payload   = sprintf('v1|%d:%s|%d', strlen($user_id), $user_id, $expires);
    $signature = hash_hmac('sha256', $payload, MAILEDITOR_PLUGIN_SECRET);

    $src = add_query_arg([
        'external_user_id'   => $user_id,
        'identity_expires'   => $expires,
        'identity_signature' => $signature,
        'plugin_version'     => '1.0.0',
    ], 'https://maileditor.net/plugin-editor/v1/' . MAILEDITOR_PLUGIN_ID);

    return sprintf(
        '<iframe src="%s" title="Email editor" allow="clipboard-write; fullscreen" style="width: 100%%; height: 100vh; border: 0"></iframe>',
        esc_url($src)
    );
});

Put [maileditor] in any page or post. Each WordPress user gets their own templates because the id is derived from get_current_user_id(). PHP's strlen counts bytes, which is what the payload requires.

Exclude the page from page caching

The signature is valid for at most 15 minutes. If a caching plugin or your host serves a cached copy of the page, visitors get an expired signature and see identity_signature_expired. Exclude the page containing the shortcode from WP Super Cache, W3 Total Cache, LiteSpeed Cache or any host-level page cache.

Next steps

Add template_id to the query arguments to open one of the user's saved templates. See Embedding the editor.
If the iframe shows "Plugin editor unavailable", read result.error in the session response. See Error codes.

Before you start

Configuration

Sign and render

Next steps

On this page