Log in (session + JWT)
curl --request POST \
--url 'https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data action=sagescreen_login \
--data 'login_nonce=<string>' \
--data 'recaptcha_token=<string>' \
--data username=john.doe \
--data password=SecurePass123 \
--data remember_me=1 \
--data redirect_to=/admin/dashboardimport requests
url = "https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login"
payload = {
"action": "sagescreen_login",
"login_nonce": "<string>",
"recaptcha_token": "<string>",
"username": "john.doe",
"password": "SecurePass123",
"remember_me": "1",
"redirect_to": "/admin/dashboard"
}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
response = requests.post(url, data=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: new URLSearchParams({
action: 'sagescreen_login',
login_nonce: '<string>',
recaptcha_token: '<string>',
username: 'john.doe',
password: 'SecurePass123',
remember_me: '1',
redirect_to: '/admin/dashboard'
})
};
fetch('https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "action=sagescreen_login&login_nonce=%3Cstring%3E&recaptcha_token=%3Cstring%3E&username=john.doe&password=SecurePass123&remember_me=1&redirect_to=%2Fadmin%2Fdashboard",
CURLOPT_HTTPHEADER => [
"Content-Type: application/x-www-form-urlencoded"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login"
payload := strings.NewReader("action=sagescreen_login&login_nonce=%3Cstring%3E&recaptcha_token=%3Cstring%3E&username=john.doe&password=SecurePass123&remember_me=1&redirect_to=%2Fadmin%2Fdashboard")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login")
.header("Content-Type", "application/x-www-form-urlencoded")
.body("action=sagescreen_login&login_nonce=%3Cstring%3E&recaptcha_token=%3Cstring%3E&username=john.doe&password=SecurePass123&remember_me=1&redirect_to=%2Fadmin%2Fdashboard")
.asString();require 'uri'
require 'net/http'
url = URI("https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/x-www-form-urlencoded'
request.body = "action=sagescreen_login&login_nonce=%3Cstring%3E&recaptcha_token=%3Cstring%3E&username=john.doe&password=SecurePass123&remember_me=1&redirect_to=%2Fadmin%2Fdashboard"
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"message": "Login successful",
"redirect_to": "/admin/dashboard"
}
}
Auth – AJAX
Log in (session + JWT)
WordPress AJAX login with reCAPTCHA/Turnstile verification.
On success, establishes a WP session cookie and issues a JWT
token pair stored in $_SESSION.
Registered as wp_ajax_nopriv_sagescreen_login — public.
Special behaviours:
- Hard maintenance mode blocks non-global-admin logins.
- Users with
memberrole or nocouncil_idare blocked (except global admins). - If a pending Stripe order session exists, it is processed and credits are appended to the redirect URL.
- TODO(productlane): BoldDesk SSO removed from this spec — the login handler still emits a BoldDesk JWT when the request originates from BoldDesk; remove or replace with the ProductLane flow.
POST
/
wp-admin
/
admin-ajax.php?action=sagescreen_login
Log in (session + JWT)
curl --request POST \
--url 'https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data action=sagescreen_login \
--data 'login_nonce=<string>' \
--data 'recaptcha_token=<string>' \
--data username=john.doe \
--data password=SecurePass123 \
--data remember_me=1 \
--data redirect_to=/admin/dashboardimport requests
url = "https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login"
payload = {
"action": "sagescreen_login",
"login_nonce": "<string>",
"recaptcha_token": "<string>",
"username": "john.doe",
"password": "SecurePass123",
"remember_me": "1",
"redirect_to": "/admin/dashboard"
}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
response = requests.post(url, data=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: new URLSearchParams({
action: 'sagescreen_login',
login_nonce: '<string>',
recaptcha_token: '<string>',
username: 'john.doe',
password: 'SecurePass123',
remember_me: '1',
redirect_to: '/admin/dashboard'
})
};
fetch('https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "action=sagescreen_login&login_nonce=%3Cstring%3E&recaptcha_token=%3Cstring%3E&username=john.doe&password=SecurePass123&remember_me=1&redirect_to=%2Fadmin%2Fdashboard",
CURLOPT_HTTPHEADER => [
"Content-Type: application/x-www-form-urlencoded"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login"
payload := strings.NewReader("action=sagescreen_login&login_nonce=%3Cstring%3E&recaptcha_token=%3Cstring%3E&username=john.doe&password=SecurePass123&remember_me=1&redirect_to=%2Fadmin%2Fdashboard")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login")
.header("Content-Type", "application/x-www-form-urlencoded")
.body("action=sagescreen_login&login_nonce=%3Cstring%3E&recaptcha_token=%3Cstring%3E&username=john.doe&password=SecurePass123&remember_me=1&redirect_to=%2Fadmin%2Fdashboard")
.asString();require 'uri'
require 'net/http'
url = URI("https://{domain}/wp-json/sagescreen/v1/wp-admin/admin-ajax.php?action=sagescreen_login")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/x-www-form-urlencoded'
request.body = "action=sagescreen_login&login_nonce=%3Cstring%3E&recaptcha_token=%3Cstring%3E&username=john.doe&password=SecurePass123&remember_me=1&redirect_to=%2Fadmin%2Fdashboard"
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"message": "Login successful",
"redirect_to": "/admin/dashboard"
}
}
Body
application/x-www-form-urlencoded
Allowed value:
"sagescreen_login"WP nonce for sagescreen_login
Cloudflare Turnstile / reCAPTCHA token
Example:
"john.doe"
Example:
"SecurePass123"
'1' to persist session, omit otherwise
Example:
"1"
Post-login redirect URL (optional, auto-determined if omitted)
Example:
"/admin/dashboard"