I have some API endpoints.

For example:

add_action('rest_api_init', function () {
    register_rest_route(MY_APP_NAMESPACE, '/init', array(
        'methods' => 'GET',
        'callback' => function (WP_REST_Request $request) {
            return get_current_user_id();

I am trying to test this endpoint with Postman.

I have generated 'X-WP-Nonce' with my localized script. And I am taking the nonce code from the browser console, and passing it through postman Headers.

But I am getting

    "code": "rest_cookie_invalid_nonce",
    "message": "Cookie nonce is invalid",
    "data": {
        "status": 403

But when I am trying with Ajax, in the same WordPress environment its works fine.

I think this is happening because the nonce is generated in a different session, so with another client, it can't respond.

My question is how can I test my API's with postman?

  • 2
    The nonce only allows WordPress to use your cookies to authenticate. When you make the request externally, like with postman, you don’t have those cookies. To make authenticated requests externally you need to implement an authentication plugin: developer.wordpress.org/rest-api/using-the-rest-api/… Aug 1, 2019 at 9:33
  • Thanks, @JacobPeattie, I was also thinking like that. Aug 1, 2019 at 9:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.