Getting 401 (access denied) when trying to use the REST API

Question

I have a WordPress site in wordpress.com with the Business plan which enables the REST API. I can test the API by listing blog posts doing a GET request to /wp-json/wp/v2/posts, but POST request to create or modify a post all return a 401. For example:

$ curl --user "flexpointtechunbreach:{application_password}" -X POST -d "title=New Title" https://testbed.flexpoint.tech/wp-json/wp/v2/posts
{"code":"rest_cannot_create","message":"Sorry, you are not allowed to create posts as this user.","data":{"status":401}}

$ curl --user "flexpointtechunbreach:{application_password}" -X POST -d "title=New Title" https://testbed.flexpoint.tech/wp-json/wp/v2/posts/8
{"code":"rest_cannot_edit","message":"Sorry, you are not allowed to edit this post.","data":{"status":401}}

flexpointtechunbreach is a user that I created and added to the site with Editor role:

I triple checked the application password was correct, generated a new one just in case and tried that.

That post, id 8, was created by the user flexpointtechunbreach:

I asked customer support at wordpress.com and they told me everything seems to be set up correctly on the WordPress site.

I'm writing a program that will interact with the API. Over there I tried many different parameters, added app_name, app_id, right or wrong credentials and nothing worked.

Any ideas what else it could be?

Answer 1

I found the problem. WordPress.com has two different application passwords. The one in the 2FA set up page is the wrong one and that's the one I was setting up. To set the right one you need to go to /wp-admin/profile.php. Once I did that, this code started working.

I wrote a blog post with lots of details about all the moving parts in case you want more details: https://pablofernandez.tech/2022/07/31/creating-blog-posts-in-wordpress-com-programatically/