I am trying to create a post through the REST API.

I am able to access the API by getting the existing posts, as per the screenshot below:

Get Posts

However, when I try to do a similar request to create a new post, the API responds that I am not allowed to create posts:

Create Post

I have tried submitting the request with my admin credentials, as well as with an editor user I created just for this. I am using basic authentication just to check if the process is working, and after that I will switch to JWT or OAuth.

What am I missing here?

UPDATE: Added a screenshot with Postman authorization tab, as that was not visible from the previous screenshot.

enter image description here

I have also tried 2 different approaches of changing .htaccess but none of them has worked. I tried adding both

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1


RewriteCond %{HTTP:Authorization} ^(.)
RewriteRule ^(.) - [E=HTTP_AUTHORIZATION:%1]

When I do a GET request to wp-json endpoint, I don't see any authentication method. Is basic authentication supposed to appear there?

enter image description here

  • 1
    You say you're using basic authentication, but I don't see any authentication being used in your screenshots. Commented Jul 4, 2018 at 8:34
  • @JacobPeattie If you take a look at the second screenshot, there is a blue dot besides Authorization signalling that authorization was being used. I could not send a screenshot showing several tabs of postman, so I showed the payload of the request. I now added a third screenshot with the authorization tab. Commented Jul 4, 2018 at 9:27
  • github.com/WP-API/Basic-Auth/issues/35 - this may assist?
    – Aravona
    Commented Jul 4, 2018 at 9:28
  • @Aravona I have also tried that, no luck. I will add this to the question just to clarify. Commented Jul 5, 2018 at 15:23

1 Answer 1


Have you tried ignoring the csrf. If not you can do it by creating a new Configuration file. Here is the configuration code to tell spring to ignore the csrf( Cross Site Request Forging) for us.

public class SpringSecurityConfig {
    public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception{
        return httpSecurity.build();

Try this and let me know if it doesn't work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.