I am new to WordPress here.

I have this request where I need to create a custom REST API plugin where when user triggers the following URL link:


The plugin will perform the following:

a. Execute CURL POST (using the username and password stored within the plugin) to retrieve the token

b. Execute CURL GET using the token retrieved, order number and coupon ID (specified in the URL) to retrieve the coupon information.

Is there any security concern the credential stored within the plugin?
Is this setup approach feasible?

Seeking experts here for advise

1 Answer 1


If you need to pass username and password for Basic Auth you need to send that in headers e.g.

$headers = array('Authorization' => 'Basic ' . base64_encode( YOUR_USERNAME . ':' . YOUR_PASSWORD );

$response = wp_remote_post( $url, array(
    'method'      => 'POST',
    'timeout'     => 45,
    'headers'     => $headers

If you need to pass username and password as value you can send it in body e.g.

$response = wp_remote_post( $url, array(
    'method'      => 'POST', // Use 'GET' for GET request
    'timeout'     => 45,
    'headers'     => array(),
    'body'        => array(
        'username' => 'test',
        'password' => 'xxxx'

//Get the response
if ( is_wp_error( $response ) ) {
    $error_message = $response->get_error_message();
    echo "Something went wrong: $error_message";
} else {
    echo 'Response:<pre>';
    print_r( $response ); // You will get the token in $response, the $response usually in JSON or XML.
    echo '</pre>';

Once you have the token you can send that in URL again to wp_remote_post function

For your other question you must encrypt any sensitive information and decrypt it when you need it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.