when I do http://dayroomstay.com/wp-json/wp/v2/users

I get:

 "code": "rest_user_cannot_view",
    "message": "Sorry, you are not allowed to list users.",
    "data": {
        "status": 401

I am using Postman... please help

  • How have you configured auth with Postman? That's an authenticated endpoint, I get the same result if I visit that endpoint ( I'm a logged out user so it's expected )
    – Tom J Nowell
    May 17, 2019 at 1:16
  • Hi Tom, thank you, May 17, 2019 at 3:15
  • could you direct me in the right directions as to how configure Auth with postman? I am new to it... May 17, 2019 at 3:17

1 Answer 1


Read the docs: you need to add a Header named X-WP-Nonce to your requests to the API that require authentication, as you can see in the jQuery example.

However the catch is getting that nonce in the first place. WordPress inject that token itself in the post editing screens. Type wpApiSettings in the developer console and you can get the nonce. You will need to send your wordpress_logged_in cookie too, that can be retrieved from the request headers in the Network tab of your browser dev tools.

I'm sharing an example of how you put that headers in your Postman request:

Postman example of Authenticated request to WordPress REST API

However making it for an app that is not coupled to the WP backend itself can be cumbersome, that´s why there are other options, like Basic authentication that I´m not a big fan, and JWT authentication plugin. Both are linked in the documentation page that I linked.

  • worked! @JesusFranco You're a genius May 18, 2019 at 13:47
  • Glad to be of help. Remember your next questions sharing the code that have you written, or in cases too complex, a minimal reproducible example, that would help the community helping you more quickly. May 18, 2019 at 20:19
  • Now I am wondering how to generate the nonce and the cookies using only the code. Oct 8, 2019 at 10:40
  • Look at the docs page it is linked, the very first code it is what you'd need to put into the controller/script/whatever you are using to send the credentials to your alternative client. Oct 8, 2019 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.