Studio integration

WordPress AI Studio is an optional development environment for an owned Mivama Hosting Service. Mivama supplies the workspace, preview, validation and deployment control; the customer supplies and authorizes its own OpenAI/Codex account.

Eligibility and launch

Core checks:

• authenticated user belongs to the service customer;
• hosting service and subscription allow access;
• selected plan enables AI editor policy;
• service state is compatible;
• current AI Studio legal package is accepted.

If eligible, Core creates a short-lived one-time launch code. Portal redirects to Studio; Studio redeems the code server-to-server using the Studio secret. Core returns a bounded session and hosting target metadata. The browser never receives Core integration secrets.

Customer-owned Codex

Studio starts Codex device authorization. The customer signs in directly to OpenAI with an owned or authorized account. Model availability, credits, limits, retention and account controls come from that OpenAI contract. Mivama does not provide the account, model, tokens or usage allowance.

Codex authentication state is stored per workspace in a private auth volume. It is not copied into WordPress, logs, backups, attachments, release archives or API responses. Logout removes the workspace session; deleting Studio data removes the auth volume.

Responsibility split

Mivama is responsible for tenant-isolated workspace operation, access control, selected context, preview, validation and controlled deployment. The customer is responsible for legal input, data minimization, its OpenAI account settings, output review and the legality/accessibility/security of published content.

Codex never publishes itself. AI output is a proposal until an authorized user reviews and explicitly approves a deployment plan.

Core integration endpoints

_portal_studio.py provides eligibility, create launch, redeem, validate/revoke session, revoke by user/service, resolve worker target and report workspace. Separate secrets are used for Studio web and privileged runner calls.

On hosting cancellation, Core revokes service sessions and calls the internal Studio archive endpoint. Final hosting deletion waits for confirmed workspace archive.