Why does Flavio ask for an Application Password?

When you connect your website, Flavio asks WordPress to create an Application Password. This is a normal WordPress feature, not something specific to Flavio, and it's how Flavio applies changes to your site.

What it is

An Application Password is a credential built into WordPress (since version 5.6) that lets an app connect to your site without using your login password. WordPress generates it, shows it once, and stores it encrypted. It's tied to one user and one app, and you can revoke it any time from your WordPress profile.

Why Flavio needs one

Flavio edits things on your site directly, like page titles, meta descriptions, and content. To do that, it needs a way to talk to your site's REST API. The Application Password is that connection.

What it can and can't do

Flavio uses this credential only to apply the content changes described during setup. It doesn't use it to log into your WordPress admin, see your password, install plugins, or change your theme.

You'll find it under Users → Profile → Application Passwords, named "Flavio Agent Plugin." Revoke it there whenever you want: Flavio stops immediately, and the rest of your site keeps working as normal.

Learn more

Application Passwords are a standard WordPress feature, not something Flavio invented. You can read WordPress's own documentation here: developer.wordpress.org – Application Passwords