I have a Javascript application in the front-end, with Wordpress in the back.

The index.php of Wordpress serves the application if user is logged in, else redirects to login page.

My application attempts to make form submissions via AJAX to Wordpress database.

Currently, I am using Formidable Forms API to submit an entry into a form, but the response I am getting is

code: "jwt_auth_bad_auth_header"
data: { status: 403 }
message: "Authorization header malformed"

My request in JavaScript is as follows:

let submission = await fetch(url, {
    method: 'POST',
    headers: {
        'Content-type': 'application/json',
        'Authorization': `Basic ${btoa(APIKEY+':x')}`
    body: payload

The problem is, I know this header should work because I have another application running (similar set up). And I have triple checked the API key itself.

At this point, I am trying to modify the server's response to send back the header, so I can determine what exactly it thinks I am sending.

Alternatively, trying to view any logs Formidable or Wordpress might keep.

How would I go about doing this?

In FrmAPIAppController.php, there seems to be a promising static method process_response:

private static function process_response( $response ) {
        $body = wp_remote_retrieve_body( $response );
        $processed = array( 'message' => '', 'code' => 'FAIL' );
        if ( is_wp_error( $response ) ) {
            $processed['message'] = $response->get_error_message();
        } elseif ( $body == 'error' || is_wp_error( $body ) ) {
            $processed['message'] = __( 'You had an HTTP connection error', 'formidable-api' );
        } elseif ( isset( $response['response'] ) && isset( $response['response']['code'] ) ) {
            $processed['code'] = $response['response']['code'];
            $processed['message'] = $response['body'];

        return $processed;

It would be great if I could just console.log some variables, but I lack knowledge/experience in PHP/Wordpress/backends in general.


  • In my dashboard, the Formidable API is activated. Also, going to mywebsite/wp-json returns a long list of endpoints including the CRUD routes for forms & entries etc.
    – achacttn
    Commented Jul 3, 2019 at 7:05
  • 1
    This seems very specific to the plugin, have you considered asking their support? There is an article about debugging WordPress, most important for you would be to set WP_DEBUG_LOG and then use error_log() (where you would use console.log() in JS)
    – kero
    Commented Jul 3, 2019 at 7:54
  • @kero Thanks for your suggestions kero. I have submitted a ticket, and check out the article.
    – achacttn
    Commented Jul 3, 2019 at 7:58
  • The error message implies that the API is expecting a JSON Web Token for authentication, and I haven't used JWT myself, but your JS appears to be sending a Basic Authentication header, not Bearer <token>, which appears to be the norm for JWT. What happens if you change the Authorization header to 'Bearer ' + APIKEY? Commented Jul 3, 2019 at 14:28
  • @JacobPeattie Hi. I've tried a few things (the results make the situation even stranger). Bearer and API key returns a 403 result Wrong number of segments. However, when using Bearer + the JWT received from simple-jwt-authentication plug in seems to return yet another 403 result Sorry, you are not allowed to create entries
    – achacttn
    Commented Jul 4, 2019 at 0:25

1 Answer 1


I'm facing the same issue now. There is a conflict between Formidable API and JWT Authentication for Wordpress Rest API plugin, none of which offer ways to deactivate authentication on specific routes.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.