Bolt.new AI and WordPress integration: Step-by-Step Guide 2025

To integrate Bolt.new with WordPress, you do not integrate “Bolt itself.” Instead, you integrate the app you build inside Bolt with WordPress using normal, real web integration methods: WordPress REST API, custom endpoints, webhooks, or plugin-based bridges. Bolt.new is simply your development workspace — it generates and runs backend code (Node/Next.js/Python) that can talk to a real WordPress site over HTTP.

 

Direct, clear answer

 

You integrate Bolt.new with WordPress by building an app inside Bolt that communicates with WordPress through the WordPress REST API (or a custom plugin/API you create). You authenticate using Application Passwords for WP-Admin accounts, or via OAuth/JWT if you want a more secure production setup. Your Bolt backend sends HTTP requests to WordPress to read/create/update/delete posts, users, media, etc. WordPress can also call your Bolt app through webhooks (using plugins like WP Webhooks) if you need two-way sync.

 

How the integration actually works (real, practical)

 

WordPress exposes a real REST API: your Bolt.new backend calls it the same way any external app would. There is no hidden “AI connector” — you wire it manually through API calls, environment variables, and a secure auth mechanism.

• Bolt.new side: you write JavaScript/TypeScript/Python to call WordPress endpoints.
• WordPress side: you enable Authentication (Application Passwords recommended for quick setup).
• Security: keep credentials in Bolt.new environment variables (never hardcoded).

 

Step-by-step: Fastest working integration

 

This is the simplest, real, working setup you can build in a Bolt project.

• Create a WordPress Application Password (WP-Admin → Users → Profile → Application Passwords).
• Store username and app password in Bolt.new environment variables.
• Call WP REST API from Bolt backend.

 

// Example: Next.js API route inside Bolt.new
// File: pages/api/createPost.js

export default async function handler(req, res) {
  const { title, content } = req.body;

  const wpUser = process.env.WP_USER;          // WordPress admin username
  const wpPass = process.env.WP_APP_PASSWORD;  // WordPress application password
  const auth = Buffer.from(`${wpUser}:${wpPass}`).toString("base64");

  const response = await fetch("https://YOUR-WP-SITE.com/wp-json/wp/v2/posts", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Authorization": `Basic ${auth}`
    },
    body: JSON.stringify({
      title,
      content,
      status: "publish"
    })
  });

  const data = await response.json();
  res.status(200).json(data);
}

 

That code is valid, real, and directly usable in Bolt.new. It creates posts on your WordPress site.

 

How WordPress can call Bolt (optional two-way integration)

 

If you want WordPress to notify your Bolt app (e.g., when a post is updated), you use a webhook plugin such as WP Webhooks. WordPress then sends POST requests to your Bolt backend. No magic — just HTTP.

• Install WP Webhooks plugin.
• Create a webhook that sends JSON to your Bolt route.
• Bolt receives it in a normal API endpoint.

 

// File: pages/api/wpWebhook.js
export default async function handler(req, res) {
  // WordPress will POST data here
  console.log("Webhook from WP:", req.body);
  res.status(200).json({ ok: true });
}

 

When to build a custom WordPress plugin

 

You only need a plugin if:

• You must expose new custom endpoints.
• You need advanced authentication like JWT or OAuth2.
• You need to trigger WP actions or filters on events.

Otherwise, the built-in WP REST API is enough.

 

How to structure this cleanly inside Bolt.new

 

• Create a services/wordpress.js file with reusable API client functions.
• Use environment variables for WP credentials.
• Test API calls directly in Bolt’s in-browser server environment.
• When deploying outside Bolt, keep the exact same env vars and code.

 

Summary

 

Bolt.new does not “plug into” WordPress by itself. You create an app in Bolt that talks to WordPress over the REST API, authenticated with Application Passwords or OAuth/JWT. That’s the real, secure, production-valid way. Everything is standard HTTP and environment variables — no proprietary connectors, no hidden magic.