when I do http://dayroomstay.com/wp-json/wp/v2/users

I get:

 "code": "rest_user_cannot_view",
    "message": "Sorry, you are not allowed to list users.",
    "data": {
        "status": 401

I am using Postman... please help

  • How have you configured auth with Postman? That's an authenticated endpoint, I get the same result if I visit that endpoint ( I'm a logged out user so it's expected ) – Tom J Nowell May 17 '19 at 1:16
  • Hi Tom, thank you, – David Delatorre May 17 '19 at 3:15
  • could you direct me in the right directions as to how configure Auth with postman? I am new to it... – David Delatorre May 17 '19 at 3:17

Read the docs: you need to add a Header named X-WP-Nonce to your requests to the API that require authentication, as you can see in the jQuery example.

However the catch is getting that nonce in the first place. WordPress inject that token itself in the post editing screens. Type wpApiSettings in the developer console and you can get the nonce. You will need to send your wordpress_logged_in cookie too, that can be retrieved from the request headers in the Network tab of your browser dev tools.

I'm sharing an example of how you put that headers in your Postman request:

Postman example of Authenticated request to WordPress REST API

However making it for an app that is not coupled to the WP backend itself can be cumbersome, that´s why there are other options, like Basic authentication that I´m not a big fan, and JWT authentication plugin. Both are linked in the documentation page that I linked.

  • worked! @JesusFranco You're a genius – David Delatorre May 18 '19 at 13:47
  • Glad to be of help. Remember your next questions sharing the code that have you written, or in cases too complex, a minimal reproducible example, that would help the community helping you more quickly. – Jesús Franco May 18 '19 at 20:19
  • Now I am wondering how to generate the nonce and the cookies using only the code. – Amir Hajiha Oct 8 '19 at 10:40
  • Look at the docs page it is linked, the very first code it is what you'd need to put into the controller/script/whatever you are using to send the credentials to your alternative client. – Jesús Franco Oct 8 '19 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.