Architecture Overview
High-level Climenos, Central and Connector responsibilities for developers.
Climenos main plugin
The main plugin loads admin, business-logic, REST, integration and builder modules. Its documented areas cover customer records, projects, tickets, finance, offers, maintenance, licensing, updater, mail, frontend portal and payment integrations.
Connector authentication
The Connector performs a server-side POST to the documented panel endpoint:
/wp-json/scp-clientops/v1/connector/panel
The request includes site identity, timestamp, nonce and an HMAC-SHA256 signature. The Connector validates the API URL, does not follow arbitrary redirects and uses no-cache request behavior.
Installation identity
Central API logic maintains a persistent installation identity and a separate installation credential. Independent clones require an explicit new identity/re-registration flow rather than mechanically reusing the original site's credentials.
Security principles from the source documentation
- Administrative changes require appropriate WordPress capability and nonce validation.
- Customer-facing endpoints must scope data to the authenticated customer.
- Secrets, Stripe credentials, signatures, passwords and raw API responses must not be exposed in public logs or REST responses.
- Server-side authorization is required; UI hiding is not sufficient.