Read the docs: you need to add a Header named X-WP-Nonce
to your requests to the API that require authentication, as you can see in the jQuery example.
However the catch is getting that nonce in the first place. WordPress inject that token itself in the post editing screens. Type wpApiSettings
in the developer console and you can get the nonce. You will need to send your wordpress_logged_in
cookie too, that can be retrieved from the request headers in the Network tab of your browser dev tools.
I’m sharing an example of how you put that headers in your Postman request:
However making it for an app that is not coupled to the WP backend itself can be cumbersome, that´s why there are other options, like Basic authentication that I´m not a big fan, and JWT authentication plugin. Both are linked in the documentation page that I linked.
Related Posts:
- Fetching all users that didn’t post with rest api (current version 2)
- Does something like is_rest() exist
- REST API purpose?
- WP REST API — How to change HTTP Response status code?
- WP REST API Is it rather easy to rename the default wp-json uri part?
- Search WP API using the post title
- Displaying a page built with Elementor using the REST API [closed]
- Understanding SHORTINIT with WordPress 5
- Does pre_get_posts affect REST API responses?
- wordpress wp-json prefix issue
- Get blog title with REST v2
- Filter post_content before loading in Gutenberg editor
- Create post using rest api with html content
- rest_post_query on multiple post types?
- Wp Rest Api Custom Endpoint for page subpages
- How should an old API version be deprecated gracefully?
- WP REST API returns incorrect data?
- WP 5.5 Fatal Error – get_rest_controller() in rest-api.php
- Why does AWStats show /wp-json* as Viewed URLs
- Display post title from WordPress excluding a string via API
- How send get request to external api with username and password
- WP_REMOTE_POST Requests are being blocked by API provider [closed]
- wp_get_object_terms() returns invalid taxonomy inside rest_api_init hook
- permission_callback has no effect
- Updating link on page via REST api
- Authenticating with REST API
- Make authorization mandatory on custom routes
- How to order WordPress Rest API data
- Why the Path is different with the one coded in rest
- WP REST API plugin 500 errors?
- wp-cli command throws error : “SSL routines:tls_process_server_certificate:certificate verify failed” while querying https website
- Setting maintenance mode via REST API
- WP API querying a custom post type and a custom field
- `rest_user_query` can’t access post author in post edit screen
- Custom endpoint to get all custom taxonomy terms
- how to avoid timeouts with remote API requests?
- Is there a way to identify a user in a custom REST API method? [duplicate]
- rest_api_init is run on every rest call to endpoint
- Curl requests sent two times
- WP-REST create user with custom meta
- receive a custom parameter with rest api
- How to get author meta into post endpoint in api v2
- If I use WordPress REST API V2 and someone makes an app using it. Will my site count the posts views from the APP? And if not, then how?
- How to store and return json in a (custom) post meta field
- Sorry, you are not allowed to list users
- Get a remote post ID via API given URL
- Core function to check if a rest namespace exists
- How to change the date and time in REST API for comments?
- Rest API V2 custom post type. I only need the title and link
- Retriving all users with REST API not working
- Is there a way to download only the Rest API part of WordPress?
- Register GET REST API route with multiple parameters
- Custom WP API endpoint NULL body data
- Making internal rest requests non-blocking?
- Is it possible to create new user from external form using REST API?
- How to include file attachment in ajax submission via the rest_api?
- What is an endpoint for custom post type comments in REST API?
- How To Bulk Import wp_postmeta records in an API call?
- Rest API in self-hosted page doesn’t work [closed]
- How would I know if my system using REST api or not?
- WordPress /users/me endpoint request forbidden
- How to display relations via wordpress Rest API
- WordPress Rest API- Allow creation of users with identical email addresses when only using rest api
- How to verify which WordPress user requested the API in ASP .NET Core?
- Inspecting WP_Rest_Request
- WP Rest_API- Post request for images returns empty
- DELETE request using WP REST API
- wp_insert_post function and automatic trashing posts once is no longer in API
- Fetching WordPress Private Posts, Public Posts Via Default REST API Endpoint
- register/login api
- Got Blank issue for get data from /wp-json/v2/post
- How do i POST to WordPress rest API from the same domain?
- WP API file_get_contents return TTP request failed! HTTP/1.1 401 Unauthorized
- WordPress improve REST API – SHORTINIT not work
- How to update a user with REST API v2 knowing only the username?
- Not able to delete media by REST API
- Need to get user data via API
- REST API retrieving posts from www.sitename.com/category/news/ instead of just just from www.sitename.com
- REST API get featured image source for custom post type
- Custom rest API route not passing data along
- Rest API encoding of double quotes
- view counter update in WordPress REST api HTTP get
- How to filter wp-json/wp/v2/users response on custom metas?
- Paid membership Pro Rest API
- wp_query json ouput
- GET request for media files in WP REST API 2 results in an empty array
- Fatal error: Call to undefined function register_rest_route()
- WordPress REST API not displaying all information
- API wp-json/wp/v2/pages/ returns a different result if page is specified
- In Rest API 2.0 is it possible to get some meta fields but not others?
- rest_cannot_create_user – Sorry, you are not allowed to create new users. CURL WORDPRESS REST API
- Getting current core version from an WordPress installation
- How to block external access to register_rest_route callback?
- Filter output of posts (Rest API)
- WordPress Application Passwords not authorizing
- Rest API nonce is being cached
- WordPress custom endpoint returns Security violated
- custom REST endpoints and application passwords
- Hide custom posts from certain taxonomy in rest api
- Creating Application Password using REST API results in 401 regardless of JWT token