Building a cordova (HTML/JS) based mobile app (not-native) and I want to use wordpress only as the backend.

The idea is that mobile app users will be making requests to the API and custom endpoints and will get the JSON response back.

Question is how to handle the authentication of users (logging into wordpress). I think oAuth cannot be used in my situation? and the only option I can think of is to use Basic Auth + Cookies.. But not sure.

Any help ?

Just to be clear, the mobile app will be a completely custom html/js interface, and it won't use the standard wordpress frontend at all.


you can write any authentication code to support the scheme you want

Someone please elaborate on this ?

  • why is it a wordpress specific question? you can write any authentication code to support the scheme you want. Mar 19, 2016 at 4:12
  • I thought it was specific to wp-api... I was reading the wp-api docs, and my situation didn't seem to fit into any, as far as auth is concerned.
    – gyaani_guy
    Mar 19, 2016 at 4:23
  • maybe you situation fits, maybe it doesn't but except for the fact that you are making some web app, you didn't say what is your situation. Anyway, for security you first select a security measure and then look into how to implement it, you should not make X security if you only have the tools for it if that sceme do not answer your need as you might just skip any security at all Mar 19, 2016 at 4:51
  • Why you can not use OAuth? Maybe not OAuth 1.0a (whih is used by the "official" WP REST API plugin for OAuth) but I think you can use OAuth 2 without any problem. Try WP OAuth Server plugin, I tried before with WP REST API successfully. Also, I've seen JSON API User plugin in action and it does the job but I've never tested it with WP REST API.
    – cybmeta
    Mar 19, 2016 at 6:56

1 Answer 1


I'm not an expert of mobile apps, but as far as I know cookies don't play well with mobile apps.

I'm working on a similar project (Angular Frontend - Wordpress Backend). Outh is by far the most secure way to go, but it's rather complicated. I'm using the wp-api-jwt-auth plugin instead.

If you configure it properly it works quite well.

As an example I share my angular code for user login:

// auth.service.ts

logIn(username: string, password: string, persist?: boolean): Observable<boolean>
    persist = persist || false;
    return this.http.post<IUser>(
        API_BASE_DOMAIN + API_BASE_PATH + '/jwt-auth/v1/token',
        { username: username, password: password, remember: persist },
            withCredentials: true, // Send cookies
    ).map(response  => {
        // login successful if there's a jwt token in the response
        if (response.token)
            // set current user data
            this.currentUser = response;

            // store username and jwt token in local storage to keep user logged in between page refreshes
            let storage = (persist) ? localStorage : sessionStorage;
            storage.setItem('currentUser', JSON.stringify(this.currentUser));

            // return true to indicate successful login
            return true;
            // return false to indicate failed login
            return false;
    error => {
        return false;

On the frontend I use auth0/jwt-auth to handle proper headers/token injection.

Hope this helps

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.