REST API: authenticate with Application Passwords
REST API: Authenticate with Application Passwords
When working with the WordPress REST API, authentication is essential to securely access or modify site data. One straightforward method is using Application Passwords, a built-in WordPress feature that allows external applications or scripts to authenticate without exposing your main user password. This tutorial explains how to authenticate REST API requests using Application Passwords, including practical code examples and testing tips.
When to Use Application Passwords for REST API Authentication
- External integrations: When connecting third-party apps or services to your WordPress site.
- Custom scripts: Automating tasks or data synchronization without manual login.
- Limited access: Granting specific permissions without sharing your main password.
- Security: Application Passwords can be revoked individually, improving control over API access.
Quick Fix: Authenticate REST API Requests with Application Passwords
- Create an Application Password for your user in WordPress admin.
- Use Basic Authentication with your username and Application Password in the REST API request header.
- Test the authentication with a simple GET request to a REST API endpoint.
- Optionally, add helper code to your
functions.phpor a mini-plugin to customize or extend authentication behavior.
Why This Happens
WordPress REST API requires authentication for endpoints that modify data or access sensitive information. Traditional methods like cookie authentication or OAuth can be complex or unsuitable for external apps. Application Passwords provide a simple, secure alternative by generating unique passwords tied to specific users, which can be used in HTTP Basic Auth headers. This method is supported natively since WordPress 5.6.
Step-by-step: Authenticate REST API with Application Passwords
1. Create an Application Password in WordPress
- Log in to your WordPress admin dashboard.
- Go to Users > Profile (or Users > Your Profile).
- Scroll down to the Application Passwords section.
- Enter a name for the new password (e.g., “API Access Script”) and click Add New Application Password.
- Copy the generated password immediately; you won’t see it again.
2. Use Basic Authentication with the REST API
Include the username and Application Password in the HTTP Authorization header using Basic Auth. The format is:
Authorization: Basic base64_encode( 'username:application_password' )Example using curl (replace username and app_password accordingly):
curl --user username:app_password https://example.com/wp-json/wp/v2/posts3. Add Optional Helper Code (functions.php or Mini-Plugin)
WordPress supports Application Passwords natively, but you can add custom validation or logging by hooking into authentication filters. Here’s a minimal example to log successful Application Password authentications:
<?php
add_filter( 'determine_current_user', function( $user_id ) {
if ( defined( 'WP_APPLICATION_PASSWORDS_TESTING' ) && WP_APPLICATION_PASSWORDS_TESTING ) {
error_log( 'User ID ' . $user_id . ' authenticated via Application Password.' );
}
return $user_id;
}, 20 );
?>
Add this code to your theme’s functions.php or create a mini-plugin by placing it in a PHP file inside wp-content/plugins/ and activating it.
4. Test the Authentication
Use a REST client like Postman, Insomnia, or curl to test your authentication:
- Set the request method (GET, POST, etc.) and URL (e.g.,
https://example.com/wp-json/wp/v2/posts). - Use Basic Auth with your WordPress username and the Application Password.
- Send the request and verify you receive a valid response without authentication errors.
Variations and Additional Tips
- Revoking Application Passwords: You can revoke any Application Password from the user profile to immediately disable access.
- Multiple passwords: Generate multiple Application Passwords for different apps or scripts.
- Custom endpoints: Application Passwords work with custom REST API endpoints that require authentication.
- HTTPS recommended: Always use HTTPS to protect your credentials during transmission.
Works on
| Environment | Compatibility |
|---|---|
| Web Servers | Apache, Nginx, LiteSpeed |
| Control Panels | cPanel, Plesk, DirectAdmin |
| WordPress Versions | 5.6 and later (native Application Password support) |
| PHP Versions | PHP 7.0+ (recommended 7.4+) |
FAQ
- Q1: Can I use Application Passwords with custom REST API endpoints?
- Yes. Application Passwords authenticate the user making the request, so any REST API endpoint that requires authentication will accept them.
- Q2: What if my Application Password is compromised?
- Immediately revoke the compromised Application Password from your user profile. This disables access without affecting your main user password.
- Q3: Can Application Passwords be used for non-REST API authentication?
- No. They are specifically designed for REST API and XML-RPC authentication.
- Q4: How do I encode the Authorization header manually?
- Base64 encode the string
username:application_password. For example, in PHP:base64_encode('username:app_password'). - Q5: Are Application Passwords supported on multisite installations?
- Yes, Application Passwords work on multisite, but each user manages their own passwords per site.