I'm relatively new to wordpress and am working on a customized site.

I have an API endpoint that I'd like to call to do authentication, because our users are going to have their credentials stored/validated by another application.

For context, API call looks something like this:

$parameters = array('email' => '[email protected]', 'password' => 'examplepassword');

    $url = 'https://example.com/api/auth?key=123APIkey' ;
    $data = wp_remote_post($url, array(
        'headers'     => array('Content-Type' => 'application/json; charset=utf-8'),
        'body'        => json_encode($parameters),
        'method'      => 'POST',
        'data_format' => 'body',

Here are two examples of $data objects which might be returned:


  "email":"[email protected]",

or if the login failed:

  "response": 401,
  "message": "Unauthorized - Invalid credentials"

Right now, I have sort of thrown this code into wp-includes/pluggable.php in the wp_authenticate($username, $password) function. But I can't seem to get anything working. How do I properly overwrite the authentication function?

Any help is appreciated and feel free to ask for more information if needed!

Thank you!!

1 Answer 1


It's better not to do so. And I'm completely against overriding the default authentication mechanism simply because of WordPress and it's plugins usually are depended on the website's database.

But if you're really into this situation WordPress provides a filter called authenticate:

add_filter( 'authenticate', 'wpse75679_auth', 30, 3 );
function wpse75679_auth( $user, $username, $password ) {
    return $user;

Just make sure you're returning an instance of WP_User when your authentication is done.

  • What about this: I add the filter to authenticate, and if the user passes the authentication with the API, I create a new user in Wordpress with those credentials. If they have logged in previously with one email and changed their password, then I will have to update the user's password if it passes the API authentication.
    – ellen
    Sep 1, 2018 at 18:47
  • The stakeholders already understand that their is going to be a problem if the user changes their email on the API platform - for our purposes (the app is going to be short-lived) it was decided that this was OK.
    – ellen
    Sep 1, 2018 at 18:49
  • As you describe your implementation, It seems good but you have to prevent users from changing their passwords or any other data that is stored on the API platform, and you have to update the password of user after each login (if it's stored as encrypted, or introduce a security flaw)
    – Farsad
    Sep 1, 2018 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.