I have a WordPress site in wordpress.com with the Business plan which enables the REST API. I can test the API by listing blog posts doing a GET request to /wp-json/wp/v2/posts, but POST request to create or modify a post all return a 401. For example:

$ curl --user "flexpointtechunbreach:{application_password}" -X POST -d "title=New Title" https://testbed.flexpoint.tech/wp-json/wp/v2/posts
{"code":"rest_cannot_create","message":"Sorry, you are not allowed to create posts as this user.","data":{"status":401}}

$ curl --user "flexpointtechunbreach:{application_password}" -X POST -d "title=New Title" https://testbed.flexpoint.tech/wp-json/wp/v2/posts/8
{"code":"rest_cannot_edit","message":"Sorry, you are not allowed to edit this post.","data":{"status":401}}

flexpointtechunbreach is a user that I created and added to the site with Editor role:

enter image description here

I triple checked the application password was correct, generated a new one just in case and tried that.

That post, id 8, was created by the user flexpointtechunbreach:

enter image description here

I asked customer support at wordpress.com and they told me everything seems to be set up correctly on the WordPress site.

I'm writing a program that will interact with the API. Over there I tried many different parameters, added app_name, app_id, right or wrong credentials and nothing worked.

Any ideas what else it could be?

  • It looks like it's accepting your credentials but failing a permission check for the post specifically. The check is here: github.com/WordPress/WordPress/blob/6.0.1/wp-includes/rest-api/… It just checks if this post type is flagged show_in_rest - is this a custom post type? - and that the user has permission to edit it.
    – Rup
    Jul 25, 2022 at 11:53
  • For the first one, it looks like you're setting the request author to some other users's ID. Can you set it to that users's ID? relevant code here
    – Rup
    Jul 25, 2022 at 11:55
  • @Rup: it's not a custom post, I just created it with the same user in the web UI of an otherwise pristine wordpress.com instance. I don't know what show_in_rest is. Anything I should check? Jul 25, 2022 at 17:25
  • @Rup: how do I set the request author? I'm not sure I follow what you mean here. The user is specified in the curl line. I haven't specified a user id anywhere else. Jul 25, 2022 at 17:26

1 Answer 1


I found the problem. WordPress.com has two different application passwords. The one in the 2FA set up page is the wrong one and that's the one I was setting up. To set the right one you need to go to /wp-admin/profile.php. Once I did that, this code started working.

I wrote a blog post with lots of details about all the moving parts in case you want more details: https://pablofernandez.tech/2022/07/31/creating-blog-posts-in-wordpress-com-programatically/

  • I tried going to /profile.php and it just shows an empty page saying "Were you looking for your API Key and other Personal Settings?". Going to there doesn't show the application password stuff either
    – Amos
    Oct 28, 2023 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.