Headless WordPress: How to authenticate front end requests?

The nonce authentication method is only for requests made from within WordPress, as described in your own link (emphasis mine):

It is important to keep in mind that this authentication method relies
on WordPress cookies. As a result this method is only applicable
when the REST API is used inside of WordPress and the current user is
logged in.
In addition, the current user must have the appropriate
capability to perform the action being performed.

Your link then describes some other methods that are available for remote requests:

While cookie authentication is the only authentication mechanism
available natively within WordPress, plugins may be added to support
alternative modes of authentication that will work from remote
applications. Some example plugins are OAuth 1.0a Server, Application
Passwords
, and JSON Web Tokens.

If you’re making authenticated requests from a React application outside of WordPress, you need to use one of those methods.

Leave a Comment