Add a Grant Access button to your own plugin
The free, open-source SDK embeds the request-and-grant flow into your product, so “can I get access to your site” stops being an email.
The problem this is for
Your support team already knows the pattern: a bug report that needs a look at the actual site, an email asking for a login, a wait, a password typed into the ticket thread, or nothing back at all because the customer doesn’t trust the ask. Multiply that across every ticket a week that needs site access, and it’s hours your team spends waiting on email instead of fixing the bug. Whenever a customer asks for help, that’s the moment you want your team inside the site fixing it, not typing another email.
What the SDK does
Adds a Grant Support Access control inside your plugin’s own admin UI. No separate app for the customer to install and trust.
Shows the customer the access window and role you configured before they click. They see it and grant it, or don’t — the duration and role are set once, by you, when you install the SDK.
Creates the account, encrypts the handoff, and reports the grant to your support desk (Help Scout, through the Connector) or your TrustedLogin dashboard.
Whenever a customer asks, your agent can be logged in and working the actual problem within minutes, with the session logged from grant to expiry.
When something other than a login needs to reach the customer, an API key, a webhook secret, one-time secrets built into the Connector handle that too, gone after one read or a set expiry, without it sitting in the ticket.
Costs nothing to embed. The SDK is free and open source at github.com/trustedlogin/client, so you can read exactly what it does on a customer’s site before you ship it.
Who’s already using it
GravityKit, SendWP, Content Control, and Hubbub have TrustedLogin embedded in their support flow today. GravityKit built TrustedLogin and still runs its own support team through it: the same grant flow, the same dashboard, the same expiry rules a customer would get — 2,589 logins across 1,789 sites since August 2024, still running at roughly 38 a month.
“We had so many awkward back and forths previously, and now it’s just BOOM, DONE, and secure all at the same time.”
Matt Cromwell, then Senior Director of Customer Experience, StellarWP (LearnDash’s parent at the time)
What it takes to ship
Install the SDK, configure which roles and durations you’ll offer, and add the button wherever your support flow already lives: a settings screen, a support tab, a reply template. Full setup steps and a reference implementation are at docs.trustedlogin.com and github.com/trustedlogin/trustedlogin-example.
One-time secrets
When a credential has to travel — an API key, a hosting login, a database password — it travels through a one-time link that TrustedLogin itself can’t open, not through the ticket. Your team creates it from your own WordPress site, and nothing about it reaches our servers. Set it to disappear the moment it’s read, or at an expiry you choose up to 30 days. Every secret leaves a record of who opened it and when.
Who this is for
For plugin and theme companies with two or more support people logging into customer sites every week, and a developer who can add a Composer dependency to the product.
If site access comes up a few times a year, the free Temporary Login Without Password plugin is the right size, and this integration isn’t worth your developer’s time.