Authentication/guides/Access Control

Authentication & Capability Gates

Choose account-specific content using the current user and WordPress capabilities.

On This Page

Authentication and capability gates

A gate selects the content inside it. Use WpAuthGate for signed-in content and WpCapabilityGate for a permission such as edit_posts.

src/components/MemberTools.tsx

1import { WpAuthProvider, WpAuthGate, WpCapabilityGate } from "@forgewp/auth"
2
3export default function MemberTools() {
4  return (
5    <WpAuthProvider>
6      <WpAuthGate fallback={<p>Sign in to see your tools.</p>}>
7        <p>Your account is available.</p>
8        <WpCapabilityGate
9          allowed="edit_posts"
10          fallback={<p>Editing is unavailable for this account.</p>}
11        >
12          <p>You can access the editorial tools.</p>
13        </WpCapabilityGate>
14      </WpAuthGate>
15    </WpAuthProvider>
16  )
17}

Permission keys are not role names

Use edit_posts or read as capabilities. A role such as subscriber groups capabilities; passing subscriber to a capability gate does not check role membership.

Table · 3 columns


Tool	Question it answers	Result
`useWpUser()`	Who is signed in?	User or null
`useWpCapability("edit_posts")`	Does this user have this permission?	Boolean
`WpAuthGate`	Which branch should a signed-in visitor see?	Children or fallback
`WpCapabilityGate`	Which branch matches a permission?	Children or fallback

Local capability checks use the user's capability array, including capabilities derived from mock roles. Hydrated gates follow current Auth state. Static exported gates become WordPress is_user_logged_in() or current_user_can() conditions; see the comparison in the overview.

Choose the protection boundary

Flowchart

Rendering diagram...

A hidden control does not protect its endpoint

A gate does not make an arbitrary browser request authorized. The endpoint serving private data or performing an action needs its own server checks.

Continue with Protected Pages.