Skip to main content
34 votes
Accepted

How to: Make JWT-authenticated requests to the Wordpress API

Why JWT authentication I'm building a site that uses Wordpress as the back-end, and a React+Redux app as the front-end, so I'm pulling all the content in the front-end by making requests to the ...
grazdev's user avatar
  • 1,323
16 votes

How to use OAuth authentication with REST API via CURL commands?

Let's go step by step here. Looks like you're trying to use OAuth just for authentication, but before you can do so you need to get the Access Token which will be used to authenticate when you make ...
sMyles's user avatar
  • 2,846
16 votes
Accepted

Why does hashing a password result in different hashes, each time?

By default, each time a new hash is generated (e.g. wp_hash_password()) WordPress salts it with random bytes, producing a unique hash for each call. The string returned from wp_hash_password() ...
bosco's user avatar
  • 6,835
12 votes
Accepted

Set up WP Authentication from External API

Update: Made a blog post to explain this better :) I was able to do this by WP's authenticate filter inside a new plugin; most of which is guided by this tutorial by Ben Lobaugh. Major points on the ...
Suika's user avatar
  • 313
10 votes

Wordpress REST API - Permission Callbacks

The issue was because I wasn't generating and sending a nonce value with the request. In order to generate a nonce value. Localize the value of a wp_create_nonce('wp_rest') function call. ...
connorb's user avatar
  • 193
8 votes
Accepted

JWT authentication with WP - Approach

This showed up as a notification due to the upvote. Here's how I solved it. The endpoint coded in the app that I am supposed to authenticate with prepares the token. The token has to be in the ...
Rutwick Gangurde's user avatar
8 votes

How to: Make JWT-authenticated requests to the Wordpress API

Complementing @grazianodev's answer, this is how you get your authorization token using cURL: /** * Generate a JWT token for future API calls to WordPress */ private function getToken() { $ch = ...
Lucas Bustamante's user avatar
7 votes

How do I require authorization / login to view a specific set of posts / pages?

This is just a modification of timshutes' answer - if you want specific pages to require login and don't want to put them into a custom post type, you can add to functions.php: add_shortcode('...
Chris Rae's user avatar
  • 291
7 votes
Accepted

How to login to WordPress site using basic authentication HTTP headers?

I would just hook into determine_current_user filter and check HTTP basic auth data to return the user. Maybe, just maybe, I would allow only specific user to be logged via HTTP auth. That could be ...
gmazzap's user avatar
  • 46.2k
7 votes
Accepted

Can I authenticate with both WooCommerce consumer key and JWT?

Yes this is possible by structuring your requests appropriately. For system requests use OAuth 1.0 (consumer key as before), but encode it to include the OAuth credentials in the URL not in the ...
lofidevops's user avatar
6 votes

How to Authenticate WP REST API with JWT Authentication using Fetch API

'Authenticate': 'Basic {what do I put here?}' // Do I need "Basic"? No, it's not Basic. It's Bearer. And the header is Authorization. So first, obtain a token from /wp-json/jwt-auth/v1/token: fetch(...
Sally CJ's user avatar
  • 39.4k
6 votes
Accepted

Can we access the REST request parameters from within the permission_callback to enforce a 401 by returning false?

I've created a reduced test case that demonstrates that what you want to do is achievable: add_action( 'rest_api_init', function() { register_rest_route( 'wpse/343039', ...
Jacob Peattie's user avatar
5 votes

wp-admin AJAX with Fetch API is done without user

After some fiddling and sparring with @t-todua I found the issue: With the Fetch API fetch call you must manually set to send cookies with a request. After setting the credentials option properly the ...
ojrask's user avatar
  • 185
5 votes
Accepted

How does the "authentication unique keys and salts" feature work?

Basically, they're hashing salts. They're used to make the results of hashing much less predictable. See https://en.wikipedia.org/wiki/Salt_(cryptography) for info on salts. AUTH is used for the /wp-...
Otto's user avatar
  • 32.7k
5 votes
Accepted

Rest API basic auth not working

The REST API does not support basic authentication out of the box, you need a plugin. The documentation points to this one, accompanied by this warning: Note that this plugin requires sending your ...
Jacob Peattie's user avatar
5 votes
Accepted

WordPress Rest API: How do we validate with our custom API key?

function checkApiAuth( $result ){ $yourEncryptAPIKey = $_GET['request']; if( yourDecryptFn( $yourEncryptAPIKey ) === $realKey ): $result = true; else: $result = false; ...
BOZ's user avatar
  • 320
4 votes

WordPress auto login after registration not working

Short answer - Your original function (mostly) works. This is your function edited to do what it needs to do: function automatically_log_me_in( $user_id ) { wp_set_current_user( $user_id ); ...
butlerblog's user avatar
  • 5,021
4 votes
Accepted

WP REST API: check if user is logged in

You shouldn't pass your nonce to your JavaScript to verify it, since client side scripts can be easily manipulated. Instead, you should get the nonce from your front-end content, and then pass it to ...
Johansson's user avatar
  • 15.3k
4 votes

authentication issue with rest api - rest_cannot_create

Authorization header is usually stripped by Apache. You can fix it with .htaccess RewriteEngine On RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
mrbarletta's user avatar
4 votes

authentication issue with rest api - rest_cannot_create

If you are here because you have already tried everything and still can't create resources via Wordpress Rest API, then let me share what worked for me. First of all, let me give you some context ...
Antony Fuentes's user avatar
4 votes
Accepted

Rest API authentication issue when called from fetch request in bundle.js

The problem is that you're not using the correct name for the REST API nonce header — the correct name is X-WP-Nonce, but you used X-WP-Header: fetch('http://localhost/wptest2/?rest_route=/wp/...
Sally CJ's user avatar
  • 39.4k
3 votes

How to use OAuth authentication with REST API via CURL commands?

Adding this as another answer to give you help to figure out how to do this. Basically as mentioned in my comments if you're going to use OAuth1 you MUST associate it with a user account, no way ...
sMyles's user avatar
  • 2,846
3 votes

Can I programmatically login a user without a password?

In addition to Mike, Paul and Sjoerd: To better handle login.php redirections: //---------------------Automatic login-------------------- if(!is_user_logged_in()){ $username = "user1"; if(...
RafaSashi's user avatar
  • 487
3 votes
Accepted

Should wordpress_logged_in cookie exist while logged out?

The function wp_logout (https://github.com/WordPress/WordPress/blob/master/wp-includes/pluggable.php#L564) calls the function wp_clear_auth_cookie (https://github.com/WordPress/WordPress/blob/master/...
Philipp Zedler's user avatar
3 votes

How to check WordPress website username and password is correct

Getting user names and passwords is a horrible idea I hope no user will actually agree to, but beyond that your idea to do it from JS is going to fail due to CORS, which means you will have to do it ...
Mark Kaplun's user avatar
  • 23.4k
3 votes

WordPress custom authentication implementation

This question Set up WP Authentication from External API has a link to a blog. That put me in the right direction and shed some light on my work (Thanks @Rup). class CustomLogin { /** * ...
SMilenaG's user avatar
3 votes

New user form rejected because "passwords don't match"—but there's only one password field

I don't have a direct solution to this, but I think I know what the problem is. I am guessing you were using Safari. I have just run into this problem myself. It's a bit maddening to get this message ...
room34's user avatar
  • 31
2 votes

Why 'Authorization Required' is coming on wordpress login

"Authorization Required" message is from the Apache world. Looks like you have set the basic authentication in apache for the login page. This is simply indicated by the "pop-up" type of the error.
prosti's user avatar
  • 4,313
2 votes

Utilize WordPress Authentication Only

Not sure, but currently in my mind the first solution. Do you need the data from WordPress for the authentication. If you include the wp-load.php you have access to WordPress and his functions, maybe ...
bueltge's user avatar
  • 17.1k
2 votes

How do I use the WP REST API plugin and the OAuth Server plugin to allow for registration and login?

I know it's a bit far fetched, but might help. For anyone looking for WP REST API implementation with JWT, here's our solution. Add it to your function.php add_action('rest_api_init', '...
Jack Song's user avatar
  • 391

Only top scored, non community-wiki answers of a minimum length are eligible