I have just started to read on OAuth as I need to integrate it within a WordPress web app. As per my understanding of OAuth, signed requests are sent between the client and the server. These signed requests are what authenticates a user/client with the server.

WordPress being a stateless application handles authentication via cookies that are sent with every request. Upon receiving the cookies with the request, WordPress automatically sets up the current user. Thus we can use conditionals like current_user_can() or user object like $current_user within the code for various user capability checks and other user actions.

A client (like an iPhone app) when authenticated via OAuth would not store or send cookies and would expect authorised access via OAuth. Since, there is no transfer of WordPress authentication cookies, WordPress would not set the user up during such requests. I'm aware that I could use wp_set_current_user() to do the same. But I'm not sure whether I need to do that OR should I do that OR my entire understanding of using OAuth with WordPress is flawed? Please help me understand how OAuth could be seamlessly integrated into vanilla WordPress environment? Also, I'm not looking for any existing plugins to do the job.

  • Your question doesn't make a lot of sense. You say "A client ... when authenticated via OAuth", but WordPress does not have any support for OAuth, and cannot do authentication via OAuth. So you'd either need: An existing OAuth provider plugin, or to write a plugin that provides OAuth authentication support. In which case, I don't understand what your question actually is. Are you asking how to do proper authentication with WordPress via a third-party system, or what?
    – Otto
    Commented Jun 26, 2013 at 17:14
  • I guess I missed the point that I plan on integrating with one of the many OAuth Providers available. Like the one here github.com/php-loep/oauth2-server. I understand the question appears to be a bit vague and that's essentially because of my not good understanding of OAuth. Once after integration of the library and once a client negotiate a authorisation with the OAuth server, how would authentication happen on WordPress side.
    – John
    Commented Jun 26, 2013 at 17:27
  • But if you're using somebody else as the provider, then you're not really authenticating to WordPress. Sorry, but I still don't understand the fundamental question here. "Authentication" means that you've proven to the system that you are some person. WordPress has two methods of authentication: username+password or auth-cookie. If you want to add some other means of authentication, then you need to write extra code to do it, or use a plugin that has the code to do it. You cannot "authenticate" via a means that isn't in the code, somewhere.
    – Otto
    Commented Jun 26, 2013 at 17:30
  • What exactly do you mean by "Once after integration of the library"? Integration of a library = writing a plugin for it. If that's what you're planning to do, then I'd highly recommend actually not doing that and using some existing plugin to do it instead. This sort of thing is tricky, and you don't want to roll your own, especially without a deep understanding of OAuth and authentication to begin with.
    – Otto
    Commented Jun 26, 2013 at 17:33
  • @Otto I was still writing the comment when I accidentally pressed return. Please see my edit to the comment. The PHP OAuth library would be part of WordPress install and would generate Consumer and Secret keys just how Twitter does it if you want to access Twitter API. Post that the client iPhone app can access the authorisation URL and negotiate access/request tokens. This all would be done by the php OAuth Library. Once this authorisation has succeeded on the library side what additionally needs to be done on WordPress side to recognise the authorization and allow access.
    – John
    Commented Jun 26, 2013 at 17:39

2 Answers 2


Okay, after your comments, I think I see what you're asking but I'm not sure, so I'll make it as generic as possible.

WordPress uses the authenticate filter hook to perform authentication. You can add additional authentication methods by connecting your own functions to this filter.

This is an example of an authentication function. This is a dangerous and dumb example, because it just logs you in as user 1 without any checks at all, but it shows what you need the function to return to authenticate a user.

add_filter('authenticate', 'myplugin_auth_example', 30, 3);
function myplugin_auth_example($user, $username, $password) {
    // if user is already known, return it
    if ( is_a($user, 'WP_User') ) { return $user; }

    // do your authentication via whatever method here
    // bottom line is that you need to get a valid WP_User object and return it

    // this example just gets user number 1 from the database and uses that
    // NOTE: this here is extremely dangerous and stupid, because it just logs everybody in instantly
    $user = new WP_User(1); 
    return $user;

    // if there is an error in authentication, you could do this instead    
    return new WP_Error( 'some_bad_auth_reason', 'Your credentials were invalid.' );

  • This gives me a starting point. Now I must ask whether the authenticate filter hook runs only when user signs in via wp-login.php OR does it run during every subsequent WordPress load when subsequent authentications is handled via WordPress authentication cookies?
    – John
    Commented Jun 26, 2013 at 18:00
  • WordPress operates in a stateless manner, it does not have "sessions". So yes, the authenticate filter runs on every connection. There is a function hooked to authenticate to have username/password, and another one to handle auth via the cookie. If you added a third one, it would run every time too.
    – Otto
    Commented Jun 26, 2013 at 19:09
  • Thanks for help @otto. I'll keep this question as unanswered until I test things out to confirm whether this is working as intended.
    – John
    Commented Jun 28, 2013 at 11:11

We developed an OAuth2 server plugin. This is our premium product: https://lana.codes/product/lana-passport/

You can try it with the demo, and there is also detailed documentation for it.

We also created a case study where we write about connecting two WordPress websites using OAuth: https://lana.codes/case-study/oauth2-server-and-client-wordpress-plugin/

OAuth Server

The OAuth2 server plugin provides the authentication server that is connected to the WordPress user system. It also provides the /authorize, /token and /resource endpoints, to which the client can connect and generate a token, and then use the token to access user data. The iPhone app (or a web app) will need to connect to these endpoints.

There are several supported grant types. The most popular is the Authorization Code grant type, because it also provides the WordPress login interface if you are not logged in and need to identify yourself.

But the User Credentials grant type is also popular for phone apps.

It is even possible to set a JWT access token for security reasons. This encrypts the data between the client and the server.

OAuth Client

The client can be anything, even another website or a phone app. We call this solution Single Sign On.

The basic structure is that the client sends requests, so it connects to the OAuth server.

For example, with the User Credentials grant type, the client provides the user credentials (ie username and password) to the /token endpoint, and then receives the access_token back.

Then use the access_token to query the user's data via the /resource endpoint. For example, if the client is another website, then using the user data, the client can register the user in the database, set their capabilities, and log them in.

Note: The client only communicates with the server through the endpoints.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.