I am using the rest api in Wordpress. For authentication I use the Basic authentication plugin (JSON Basic Authentication)

I use this request (from both postman and nodejs):

POST /wp-json/wp/v2/posts HTTP/1.1
Host: **************
Authorization: Basic *********************
Content-Type: application/json
Cache-Control: no-cache

{ "title": "test", "content": "test", "status": "private", "excerpt": "test" }

When testing locally on my server, it works fine but on a VPS I get the following error:

    "code": "rest_cannot_create",
    "message": "Sorry, you are not allowed to create posts as this user",
    "data": {
        "status": 401

I know the user credentials are correct and the user is allowed to create posts.

I suspect that the auth header is lost somewhere before arriving to rest-api. But where should I start debugging? Which logs?

3 Answers 3


Authorization header is usually stripped by Apache.

You can fix it with .htaccess

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

If you are here because you have already tried everything and still can't create resources via Wordpress Rest API, then let me share what worked for me.

First of all, let me give you some context here, I got WordPress launched on an AWS instance using Bitnami.

Then I installed WooCommerce and enabled its API in order to play with it as a sandbox system. Immediately after that, I tried to create products using Postman but every time I got errors like "woocommerce_rest_cannot_create" ("Sorry, you are not allowed to create resources."). I tried different authentication methods such as OAuth and Basic Auth but none of them worked.

So I thought that maybe I should try WordPress API endpoint instead (instead of Woocommerce's endpoint) and see if I could create posts or users, though that didn't work either. I got errors like:

  • "rest_cannot_create" ("Sorry, you are not allowed to create posts as this user.")
  • "rest_cannot_create_user" ("Sorry, you are not allowed to create new users")

Here is what worked for me:

  • Install Basic Auth plugin, you can install it by cloning the repo into /opt/bitnami/apps/wordpress/htdocs/wp-content/plugins and then activate it from the plugins page in WP Admin page. Or you can also download the repo as a zip and install from a file from the plugins page in WP Admin.
  • Change postman (or whatever you are using to send your requests) to use Basic Auth. Use the creds of an existing Administrator user.
  • Edit the .htaccess file available in /opt/bitnami/apps/wordpress/htdocs (This file is hidden, don't freak out if you can't see it)
  • Add a new line under RewriteEngine On and insert RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}] save and exit
  • Edit /opt/bitnami/apps/wordpress/conf/httpd-app.conf add a new line after RewriteEngine On
  • In the new line insert: RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] save and exit
  • Restart Apache: sudo /opt/bitnami/ctlscript.sh restart apache
  • (OPTIONAL) Install Application Passwords By George Stephanis

Then I tried again from Postman and everything worked flawlessly.

For more details check: https://community.bitnami.com/t/setting-up-api-access-to-wordpress-on-aws-ec2-instance/60589/7

  • 2
    mate you just saved my two days
    – Codecraker
    Jun 23, 2020 at 20:16
  • Happy to hear that @Codecraker :-) Jun 24, 2020 at 21:11
  • 1
    Followed all the above steps but no luck :-( Sep 28, 2020 at 11:13

For me, I found that the answer was that I had to create and use a WordPress Application Password, instead of using the normal login password. A regular password wouldn't work via the API.

Application Passwords were introduced in WordPress 5.6, so this could be relatively new for some: https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.