← Back to Blog

REST API Authentication

Separate authentication from authorization and select credentials according to client, scope and revocation needs.

Veyra Admin

2 min read

  • Article
  • Intermediate
  • 2 minutes read
  • Reviewed August 4, 2026
  • Advanced WordPress and integrations

REST API authentication establishes which WordPress user or application is making a request.

Authorization is a separate step that determines whether that identity can perform the requested operation.

Browser code running inside WordPress can use the existing logged-in session.

State-changing REST requests also use a REST nonce, commonly sent through the X-WP-Nonce header.

The nonce helps protect request intent but does not replace endpoint capability checks.

Application Passwords

External scripts and applications can authenticate with a username and revocable Application Password over HTTPS.

The credential belongs to a user and inherits that user's capabilities.

It should be named, stored securely and revoked when the integration is removed.

OAuth and Identity Providers

OAuth plugins or external identity systems can be appropriate when clients require delegated access, scoped authorization, user consent or centralized identity.

WordPress core does not provide one universal OAuth server for every external-client scenario.

Basic Authentication Plugins

Development plugins that accept a user's normal password through Basic Authentication are useful for local testing but are not the preferred production pattern.

Do not send credentials over HTTP.

Authorization at the Endpoint

Every protected custom route needs a permission_callback.

Check a capability or object-specific permission rather than only whether a user is logged in.

Credential Storage

External clients should use:

  • Secret managers.
  • environment variables.
  • protected deployment configuration.
  • revocable credentials.
  • documented rotation.

Never embed production secrets in public JavaScript.

Frequently Asked Questions

Is a REST nonce an API key?

No. It is tied to the browser session and request context.

Does authentication allow access to every endpoint?

No. The authenticated user still needs the required capabilities.

Continue Learning

Previous: The WordPress REST API

Next: Application Passwords