From cae4853696f3bc722d93e5c999cb828ee139ab79 Mon Sep 17 00:00:00 2001 From: opencode Date: Mon, 3 Aug 2026 21:47:05 +0800 Subject: [PATCH] docs: clarify GET requires query token, POST accepts header token in permission docblock --- includes/class-peptide-news-rest-worker.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/includes/class-peptide-news-rest-worker.php b/includes/class-peptide-news-rest-worker.php index 65ceac0..34f2c07 100644 --- a/includes/class-peptide-news-rest-worker.php +++ b/includes/class-peptide-news-rest-worker.php @@ -23,7 +23,11 @@ class Peptide_News_Rest_Worker { /** * Check whether the incoming request is authenticated as an admin - * OR bears a valid VPS worker secret token in X-Peptide-News-Token header. + * OR bears a valid VPS worker secret token. + * + * GET requests (pending) require the token as a query parameter so + * cached responses are namespaced by the secret; POST requests accept + * the X-Peptide-News-Token header (or query token) or an admin session. * * @param WP_REST_Request $request * @return bool|WP_Error