Update: Made a blog post to explain this better 🙂
I was able to do this by WP’s authenticate filter inside a new plugin; most of which is guided by this tutorial by Ben Lobaugh. Major points on the plugin:
- Make an API call function using cURL (you can get guide codes from Postman upon testing if you don’t know already).
- Add filter checking if the response from the call says the user is existent and has access (based on user role in my case).
- Still using the filter, check if the user already has an account on the WP site – if not, create one for them using
wp_insert_user. For clarification, I used the email and password verified by the API because WP requires a registered user on its database. - If the user already exists on the WP database, make sure their credentials are the same using
wp_update_user. These are for cases like when they changed their details on the main non-WP website. - Optionally, add a settings page for the plugin. In my case, I created a field for the Request URL by following this tutorial by Bharat Pareek.