# Pinterest Feed Widget
> Renders Pinterest content from the connected account — user pins, board pins, or boards list — via the Pinterest v5 REST API. OAuth credentials live site-wide in the EA Dashboard; one connection serves all widget instances.
**Class file:** `includes/Elements/Pinterest_Feed.php` (2832 lines)
**Slug:** `pinterest-feed` (widget id `eael-pinterest-feed`)
**Public docs:**
**Pro-shared:** Pro-only. **External integration: Pinterest API v5** (`api.pinterest.com/v5`, OAuth 2.0).
## Overview
Three feed types — **User Pins**, **Board Pins** (per-board), **Boards** (board cards) — rendered in one of five layouts: Grid Overlay, Masonry Overlay, Polaroid Wall, Card Slider, Featured Slider. Boards feed is limited to Grid + Slider since pin-specific skins would render duplicates. OAuth runs through a custom `/eael-pinterest-auth/` front-end rewrite (Pinterest rejects redirect URIs that carry query parameters). Tokens auto-refresh via WP-Cron ~10 min before expiry, with an inline 5-min-buffer fallback inside `get_current_pinterest_access_token()`.
## Pro vs Lite
Pro-only. No Lite counterpart, no Extender hook.
## File Map
| File | Role |
| --- | --- |
| `includes/Elements/Pinterest_Feed.php` | Widget class — controls + render orchestration |
| `includes/Traits/Pinterest_Feed.php` (1520 lines) | OAuth flow, token refresh, API fetchers, transient cache, AJAX load-more handler |
| `src/css/view/pinterest-feed.scss` (1501 lines) → `assets/front-end/css/view/pinterest-feed.min.css` | All five layouts + boards card + profile header + slider styles |
| `src/js/view/pinterest-feed.js` (177 lines) → `assets/front-end/js/view/pinterest-feed.min.js` | Swiper init for `layout-4`/`layout-5`, force-square ResizeObserver, load-more AJAX |
| `assets/front-end/css/view/load-more.min.css` | Pagination button CSS (Lite-owned — referenced via `EAEL_PLUGIN_PATH` in `config.php:1256`) |
| `config.php` entry `'pinterest-feed'` (`:1251`) | Mixed Lite + Pro CSS, self JS |
| Site option `eael_pinterest_client_id` / `_client_secret` | App credentials saved from EA Dashboard |
| Site option `eael_pinterest_access_token` / `_refresh_token` / `_token_expires_at` / `_user_info` | Per-site OAuth state |
| Site option `eael_pinterest_connection_status` | `''` or `'revoked'` |
## Architecture
- **Site-wide OAuth, not per-widget tokens.** All instances read `get_option( 'eael_pinterest_access_token' )` via `get_current_pinterest_access_token()` (`Traits/Pinterest_Feed.php:409`). A **legacy per-widget `eael_pinterest_feed_access_token`** setting is still read from raw `_elementor_data` post meta in `Elements/Pinterest_Feed.php:165-178` as a migration fallback — keep both paths until older saved widgets are migrated.
- **Custom rewrite for OAuth callback** — `^eael-pinterest-auth/?$` (`Traits/Pinterest_Feed.php:32`). Pinterest's v5 OAuth does not accept redirect URIs with query strings; the rewrite mints a clean URL. Schema version pin `eael_pinterest_rewrite_version=v1` auto-flushes once (`:35`); bump the version string if the slug changes.
- **State nonce is user-bound** (`wp_create_nonce( 'eael_pinterest_oauth' )` → `wp_verify_nonce` at `Traits:180`). Only the admin who started the flow can complete it.
- **Token endpoint uses HTTP Basic auth** for client credentials, not POST body (`Traits:197-220`, `:326-345`). Pinterest v5 rejects POST-body client auth.
- **Token refresh = two paths in one.** A scheduled single event `eael_pinterest_feed_token_refresh` fires ~10 min before expiry (`Traits:267`); `get_current_pinterest_access_token()` also refreshes inline if called within a 5-min buffer of expiry. On cron failure, a fallback retry is rescheduled for `time() + HOUR_IN_SECONDS` (`:322`).
- **Refresh-token rotation honoured** — when the token endpoint returns a new `refresh_token`, the new value overwrites the previous one in the same write. See [`.claude/rules/external-api-integrations.md`](../../.claude/rules/external-api-integrations.md) § Google APIs for the rotation rule (same pattern applies here).
- **AJAX load-more** registered in `Bootstrap.php:228-229` against both `wp_ajax_pinterest_feed_load_more` and `wp_ajax_nopriv_pinterest_feed_load_more`. Bookmark pagination is provided by Pinterest's `bookmark` cursor (saved into the transient with the page payload at `Traits:643`).
- **Two-layer transient cache** — page payload + cache-duration sentinel. The companion `_dur` transient lets the trait detect when the user changed the TTL setting and invalidate the data transient (`Traits:488-493`, `:621-624`). Cache key includes the Pinterest username so a token rotation that keeps the same identity doesn't orphan the cache (`:615`).
- **Render short-circuits when not connected** — `render()` returns early if `get_current_pinterest_access_token()` is empty (`Elements:2610`). Avoids rendering empty wrappers and stale slider markup.
- **Editor-only `data-settings` payload** — when in `Plugin::instance()->editor->is_edit_mode()`, every visibility / layout / count setting is serialized into a `data-settings` attribute on the load-more button so the editor preview reflects unsaved changes without a server round-trip (`Elements:2734-2769`). Frontend renders never carry this payload.
- **Boards feed has its own layout control + own style section.** `eael_pinterest_feed_layout_boards` (only Grid + Slider) keeps the boards card visual independent of the pin-layout state so switching feed type doesn't ship a broken render.
## Render Output
```html
[?]