WP REST API and Postman - Using Application Passwords in WordPress

What are Application Passwords in WordPress and how can I use them? Let's dig into the WP REST API and how you can make authenticated API calls from tools like Postman (and any other code base) by using core WordPress's Application Passwords feature.

Chapters

00:00:00 Application Passwords
00:00:51 Documentation
00:01:14 Permissions and Authentication
00:02:30 Hitting Endpoints in Postman
00:03:17 Getting an Application Password
00:04:42 Setting up Basic Auth in Postman
00:06:02 Next Steps

[Lukasz-online]

Great intro Brian! - You should def write/do more videos on this topic because I also noticed very little content on app passwords. - we need more use cases!

[Drivingralle]

Would love to see a details video about the access sharing you showed at the end

[tingtongraas]

Thanks for this. It did help. After setting up an application password and adding the auth credentials to postman I was still getting a rest_forbidden response. The site I am working on has wordfence installed and it turns out that wordfence disables application passwords by default. After changing the wordfence setting it worked fine.

[dandin]

Thanks for the video! I was wondering, can you show maybe how to block the public api totally and then reach it via api key? So basically I am looking for a way to implement it as Machine-to-machine technique, reaching the api only from my server (node.js)...

[TheCasualGamerYT]

Still getting 401... But a third party using one of my application passwords work... Must be some form of plugin issue I imagine?

[AshishBanerjee]

How can we use this for checking theme license? Suppose i created a theme to sell, user bought from woocomerce website and then installs the theme in their website. Can we send them application password as theme license, if yes then how can we check of the license is valid if someone else copies the license and tries to install the theme

[JasonHenkel-nceg]

Hi Brian, thanks so much for the tutorial! I followed it step by step, but I am still receiving an error for INVALID_PASSWORD. I have tried an application password, as well as my regular password. I even created a new user, and reset the passwords for both users. I've tried from a custom code configuration as well as in postman. Do you have any idea why I am still encountering this error? Thanks!

[nickywan]

If I am building custom rest api endpoints for 3rd party service to call it, would you recommend application password for authentication? I believe we have other forms of auth like cookie based auth, oAuth, etc. What about using api key ?
i cannot find any documentation on how to generate api key for auth purpose, can you make a video about it?

[onelook]

Just wanted to know if the slug of custom part your can be removed or not