The only multi domain spiritual intelligence plugin for WordPress. Drop natal charts, daily horoscopes, kundli, forecast timelines, Human Design bodygraphs, BaZi Four Pillars charts, and feng shui Flying Star charts onto any page. One API key, 18+ spiritual data domains, 258+ endpoints. Verified against NASA JPL Horizons.

Interactive forms for your visitors. Gutenberg blocks for your editor. Shortcodes for anywhere else. Server side rendering keeps your API key out of the browser. Transient caching keeps your quota intact.

• 19 hero shortcodes covering Western astrology, Vedic astrology (kundli, panchang, mangal dosha, KP chart, gun milan), Forecast (the cross-domain timeline), Human Design (the bodygraph), Numerology, Tarot (daily, three card, yes or no), biorhythm, angel numbers, crystals by zodiac, current moon phase, and two-chart compatibility (synastry, gun milan, Western compatibility). Every reading ships a matching Gutenberg block generated from the same spec, with sidebar controls for its inputs and a live preview in the editor. The Horoscope block adds a variation picker.
• Auto generated shortcodes for the long tail. Every endpoint in the RoxyAPI OpenAPI spec is reachable from a shortcode.
• Form mode on every hero shortcode. Let visitors submit their own sign, name, birth date, or question and render a personalized reading. No JavaScript required.
• Zero client side secrets. All calls run in PHP. The API key never reaches the browser.

Three pages any spiritual practitioner can launch in an afternoon:

• Daily horoscope page. One shortcode, twelve sign picker, cached for one hour per sign. [roxy_horoscope]
• Numerology reading page. A form that asks for name and birth date, returns Life Path, Expression, Soul Urge, Personality numbers, and a narrative interpretation. [roxy_numerology]
• Tarot reader page. A form that takes a question and draws a three card spread with interpretation. [roxy_tarot_card spread="three"]

All three pages monetize the same way: drop an email opt in, a Stripe buy button, or a Patreon link below the shortcode. The plugin handles the reading, you keep the audience.

Every hero shortcode works in two modes. Pass all required attributes for a static reading that the site owner controls. Omit them and the shortcode renders a form so visitors submit their own inputs.

[roxy_horoscope sign="aries"]
[roxy_tarot_card spread="three" question="What should I focus on this week"]
[roxy_tarot_yes_no question="Should I take the new job"]
[roxy_numerology name="Ada Lovelace" birth_date="1815-12-10"]
[roxy_life_path birth_date="1990-05-15"]
[roxy_natal_chart birth_date="1990-05-15" birth_time="14:30" lat="40.7128" lon="-74.0060" tz="America/New_York"]
[roxy_kundli birth_date="1988-01-12" birth_time="09:45" lat="19.0760" lon="72.8777" tz="Asia/Kolkata"]
[roxy_panchang date="2026-10-15" lat="12.9716" lon="77.5946" tz="Asia/Kolkata"]
[roxy_mangal_dosha birth_date="1992-09-08" birth_time="22:30" lat="13.0827" lon="80.2707" tz="Asia/Kolkata"]
[roxy_kp_chart birth_date="1990-05-15" birth_time="14:30" lat="28.6139" lon="77.2090" tz="Asia/Kolkata"]
[roxy_moon_phase]
[roxy_bodygraph birth_date="1990-05-15" birth_time="14:30" lat="40.7128" lon="-74.0060" tz="America/New_York"]
[roxy_biorhythm birth_date="1990-05-15" target_date="today"]
[roxy_angel_number number="1111"]
[roxy_crystals_by_zodiac sign="aries"]

Two-chart compatibility heroes ([roxy_synastry], [roxy_gun_milan], [roxy_compatibility]) are form-mode only because static mode would need ten or more inline attributes per chart, and so is the forecast timeline ([roxy_forecast]), whose birth details and date window nest inside one request. Drop the shortcode on a page and visitors fill in the details themselves.

Leave the attributes off and the shortcode renders an input form for your visitors:

[roxy_horoscope]            → zodiac sign picker
[roxy_natal_chart]          → birth date, time, and city picker
[roxy_kundli]               → Vedic birth date, time, and city picker
[roxy_panchang]             → date and city picker
[roxy_mangal_dosha]         → Vedic birth chart input
[roxy_kp_chart]             → Vedic birth chart input
[roxy_synastry]             → two birth charts (Western synastry)
[roxy_gun_milan]            → two birth charts (Vedic Ashtakoota)
[roxy_compatibility]        → two birth charts (Western compatibility score)
[roxy_forecast]             → birth details and an optional forecast window
[roxy_bodygraph]            → birth date, time, and city picker
[roxy_tarot_card]           → question input with spread selector
[roxy_tarot_yes_no]         → question text input
[roxy_numerology]           → name and birth date form
[roxy_life_path]            → birth date picker
[roxy_biorhythm]            → birth date input
[roxy_angel_number]         → number input
[roxy_crystals_by_zodiac]   → zodiac sign picker

Form submissions post back to the same page over HTTPS. The plugin validates the nonce, rate limits per IP, calls RoxyAPI server side, and renders the result above the form. Nothing to wire up, nothing to style. Override the template from your theme if you want a custom layout.

In the block editor, open the inserter and pick a block from the RoxyAPI category. The headline readings, of which Horoscope adds a variation picker:

• Horoscope (daily, weekly, monthly, yearly)
• Natal Chart and Moon Phase
• Vedic Kundli, Panchang, Mangal Dosha and KP Chart
• Bodygraph (Human Design)
• Tarot (daily, three card, Celtic Cross) and Tarot Yes or No
• Numerology (life path, expression, soul urge, full chart) and Life Path
• Biorhythm
• Angel Number
• Crystals by Zodiac

Beyond these, every long-tail endpoint (Chinese astrology, feng shui, Human Design, forecasts, I Ching, dream symbols, crystals, and more) generates a matching block from the OpenAPI spec, listed under its own RoxyAPI: every reading category so the headline readings stay one short list. Every block, headline readings included, is generated the same way and gets sidebar controls for its inputs derived from the spec params (a date picker for dates, a dropdown for enums, text and number fields for the rest), with a live server-rendered preview. Only readings that need two charts or nested birth details (such as synastry or gun milan) stay shortcode and visitor-form only, because the block editor cannot collect their nested input.

All blocks are built flat under build/blocks/<name>/ and registered with a single directory scan using only register_block_type, so the plugin stays compatible with its declared minimum WordPress version (6.5) with no version-gated core functions.

The Astrology Section wrapper block sets a default zodiac sign for the Horoscope blocks placed inside it, so one setting drives several horoscopes on a page.

Every block renders server side through the same RoxyAPI client the shortcodes use. Same caching, same rate limiting, same secret handling.

1. Install. Plugins, Add New, search "RoxyAPI Astrology Vedic Tarot Numerology", click Install Now, then Activate.
2. Get an API key. Pick a plan at roxyapi.com/pricing. One key covers every reading. Pricing is shown in your local currency.
3. Paste the key. RoxyAPI menu in the WordPress admin, paste the key, Save key. The plugin encrypts the key at rest via AES 256 CTR.
4. Drop a shortcode. Add [roxy_horoscope] to any page and publish. Visitors can now pick their sign and read their horoscope.

That is the whole setup. Thirty minutes from install to live page.

For production hosts that inject secrets via environment variables (Pantheon, WP Engine, Kinsta, Bedrock), define the constants in wp-config.php and the plugin picks them up automatically:

define( 'ROXYAPI_KEY',             getenv( 'ROXYAPI_KEY' ) );
define( 'ROXYAPI_ENCRYPTION_KEY',  getenv( 'ROXYAPI_ENCRYPTION_KEY' ) );
define( 'ROXYAPI_ENCRYPTION_SALT', getenv( 'ROXYAPI_ENCRYPTION_SALT' ) );

When ROXYAPI_KEY is defined, the settings field is read only and the constant takes priority. Your key never enters the database.

Every endpoint is cached with a per endpoint TTL so cached responses do not cost API quota. Object cache backends (Redis, Memcached) are picked up automatically.

• Server side rendering. The plugin makes every API call in PHP. The key never reaches the browser.
• Encrypted at rest storage. AES 256 CTR with a key derived from ROXYAPI_ENCRYPTION_KEY constant or LOGGED_IN_KEY fallback. Ported from the Google Site Kit Data_Encryption pattern.
• Rate limiting. Visitor submitted forms are rate limited per IP per shortcode via WordPress transients to prevent abuse.
• Theme aware. Every class is prefixed .roxyapi-* and uses var(--wp--preset--color--*) tokens from the active theme theme.json. Override from your child theme or just override the class.
• Interface translation, not only the readings. Text domain roxyapi. Ships built in catalogues for German, Spanish, Hindi, Turkish, Portuguese, French and Russian, covering the settings screens, the birth details form, and every message a visitor reads.
• WCAG 2.1 AA. Proper heading order, labeled inputs, keyboard navigation, color contrast.

The RoxyAPI admin page is split into five tabs:

• Connect. Paste the API key, test the connection.
• Branding. Four ready-made palettes, or seven colors set by hand with a light and a dark value each, plus a light, dark, or auto theme and the reading language.
• Display. Written readings on or off, hidden sections, the source credit, an optional disclaimer line, and the visitor form copy.
• Privacy. Visitor consent label. Birth date and time are special category data under GDPR Article 9; submission is gated on an explicit opt in checkbox and the plugin registers privacy policy content via wp_add_privacy_policy_content.
• Advanced. Cache preset (fresh / balanced / quota saver) and a connection status panel.

Form mode shortcodes also surface a city autocomplete (RoxyAPI geocoder, ARIA 1.2 combobox) so visitors can pick a city instead of typing latitude, longitude, and timezone by hand. The plugin proxies queries through /wp-json/roxyapi/v1/geocode so the API key never reaches the browser.

Form submissions and city lookups are rate limited per visitor address, and only REMOTE_ADDR counts: a forwarded header can be set by whoever is making the request unless your own edge rewrites it, so trusting one by default would let a visitor mint a fresh bucket per request. Behind a proxy every visitor therefore shares one bucket until you opt a header in.

add_filter(
	'roxyapi_trusted_proxy_headers',
	function ( $headers, $remote_addr ) {
		return array( 'HTTP_CF_CONNECTING_IP' );
	},
	10,
	2
);

roxyapi_client_ip is still there for custom setups that would rather return the address themselves.

RoxyAPI ships four official clients. Same data, different stacks:

• WordPress plugin (this repo): wordpress.org/plugins/roxyapi
• TypeScript SDK: github.com/RoxyAPI/sdk-typescript
• Python SDK: github.com/RoxyAPI/sdk-python
• MCP server for AI agents: roxyapi.com/docs/mcp

• Documentation
• Interactive API reference
• Pricing and API keys
• WordPress.org listing
• Issues

Clone the repo and spin up wp-env to hack on the plugin:

git clone https://github.com/RoxyAPI/sdk-wordpress.git roxyapi
cd roxyapi
composer install
npm install
npm run wp-env start

Use npm run wp-env, never a bare npx wp-env. The script wraps the command in NODE_OPTIONS=--no-network-family-autoselection, and without it the command dies at Reading configuration with AggregateError [ETIMEDOUT] on any machine whose IPv6 route is broken. wp-env pulls the WordPress and Plugin Check zips through Node, and Node abandons the unreachable address rather than falling back to the one that works, which is why curl succeeds on the same host at the same moment. The phpunit and plugin-check git hooks already set the same flag.

The first composer install and npm install generate composer.lock and package-lock.json. These lockfiles are committed to the repo so CI can run npm ci reproducibly. If you bump a dependency, commit the updated lockfile in the same PR.

The plugin is mounted at http://localhost:8888 with Plugin Check auto activated. Default login is admin / password.

Tests, linting, static analysis, and the build:

vendor/bin/phpunit
vendor/bin/phpcs
vendor/bin/phpstan analyze
npm run build:all

Regenerate the auto generated PHP client and long tail shortcodes from the live OpenAPI spec:

npm run generate

CI runs npm run generate:check on every pull request and fails if the repo drifts from the live spec. Resolve by regenerating and committing the diff.

See AGENTS.md for the full agent-facing guide.

GPL-2.0-or-later. See LICENSE. WordPress plugins must ship under a GPL compatible license, so this repo uses GPL-2.0-or-later while the sibling TypeScript and Python SDKs use MIT.