authentication issue with rest api - rest_cannot_create

Question

I am using the rest api in Wordpress. For authentication I use the Basic authentication plugin (JSON Basic Authentication)

I use this request (from both postman and nodejs):

POST /wp-json/wp/v2/posts HTTP/1.1
Host: **************
Authorization: Basic *********************
Content-Type: application/json
Cache-Control: no-cache

{ "title": "test", "content": "test", "status": "private", "excerpt": "test" }

When testing locally on my server, it works fine but on a VPS I get the following error:

{
    "code": "rest_cannot_create",
    "message": "Sorry, you are not allowed to create posts as this user",
    "data": {
        "status": 401
    }
}

I know the user credentials are correct and the user is allowed to create posts.

I suspect that the auth header is lost somewhere before arriving to rest-api. But where should I start debugging? Which logs?

Answer 1

Authorization header is usually stripped by Apache.

You can fix it with .htaccess

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

Answer 2

If you are here because you have already tried everything and still can't create resources via Wordpress Rest API, then let me share what worked for me.

First of all, let me give you some context here, I got WordPress launched on an AWS instance using Bitnami.

Then I installed WooCommerce and enabled its API in order to play with it as a sandbox system. Immediately after that, I tried to create products using Postman but every time I got errors like "woocommerce_rest_cannot_create" ("Sorry, you are not allowed to create resources."). I tried different authentication methods such as OAuth and Basic Auth but none of them worked.

So I thought that maybe I should try WordPress API endpoint instead (instead of Woocommerce's endpoint) and see if I could create posts or users, though that didn't work either. I got errors like:

• "rest_cannot_create" ("Sorry, you are not allowed to create posts as this user.")
• "rest_cannot_create_user" ("Sorry, you are not allowed to create new users")

Here is what worked for me:

• Install Basic Auth plugin, you can install it by cloning the repo into /opt/bitnami/apps/wordpress/htdocs/wp-content/plugins and then activate it from the plugins page in WP Admin page. Or you can also download the repo as a zip and install from a file from the plugins page in WP Admin.
• Change postman (or whatever you are using to send your requests) to use Basic Auth. Use the creds of an existing Administrator user.
• Edit the .htaccess file available in /opt/bitnami/apps/wordpress/htdocs (This file is hidden, don't freak out if you can't see it)
• Add a new line under RewriteEngine On and insert RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}] save and exit
• Edit /opt/bitnami/apps/wordpress/conf/httpd-app.conf add a new line after RewriteEngine On
• In the new line insert: RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] save and exit
• Restart Apache: sudo /opt/bitnami/ctlscript.sh restart apache
• (OPTIONAL) Install Application Passwords By George Stephanis

Then I tried again from Postman and everything worked flawlessly.

For more details check: https://community.bitnami.com/t/setting-up-api-access-to-wordpress-on-aws-ec2-instance/60589/7

Answer 3

For me, I found that the answer was that I had to create and use a WordPress Application Password, instead of using the normal login password. A regular password wouldn't work via the API.

Application Passwords were introduced in WordPress 5.6, so this could be relatively new for some: https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/