Skip to main content

FluentCRM

#General

MCP

I have started connecting Claude to the Fluent suite and one thing I want to get right before I rely on this. The connector creates the Application Password under the currently logged in user, which for most of us is an administrator.

An Application Password inherits that user's full role, which could become a security issue.

My questions:

  • Is the recommended setup a dedicated WordPress user per connector, with only that plugin's capabilities, instead of an admin account?
  • Different connectors clearly need different privilege levels (a page builder touching global settings vs a read heavy CRM query). Is anyone mapping roles per connector, and how?
  • Any guidance on lifecycle: keep connections always on or enable them per working session and rotate the passwords?

Curious how others are handling this.

  • 3 likes
  • 2 comments

Jason Janes

Personally what I do is setup a new user. I use Claude so I setup a new user with admin access or whatever access you want to give your AI agent.

username: claude
password: LongAssHashwith$%^&*())

Then add the application passwords as necessary.

By using this method you effectively setup an audit trail, and can revoke access as necessary instead of having to change all of your own credentials.

All the Best,
Jason

Manuel Müller

Thanks Jason Janes , that matches what I ended up doing, and the revocable audit trail is the main win.

One thing I have since worked out: for the Fluent plugins you usually do not need to give that user admin. Each plugin has its own permission manager, so a plain Subscriber level WordPress user is enough and you assign the real rights inside the plugin:

  • FluentCRM: Settings, Managers
  • FluentCart: Settings, Roles (Accountant is read only, a good default)
  • FluentForm: the Managers section in Settings
  • FluentBoards: only "Member" on the specific board, which covers task management

That keeps the blast radius small. If the application password ever leaks, whoever holds it can only reach what that user is allowed to do in each plugin, not your whole site. The one exception is a page builder like Breakdance, which genuinely needs admin level access, so I keep that connector separate and only enable it while I am actively building.

One more thing I do: a separate application password per connector, so I can revoke one without breaking the others