Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script
Take a closer look at the function rest_cookie_check_errors(). When you get the nonce via /wp-json/nonce/v1/get, you’re not sending a nonce in the first place. So this function nullifies your authentication, with this code: if ( null === $nonce ) { // No nonce at all, so act as if it’s an unauthenticated request. wp_set_current_user( 0 … Read more