# Connecting apps to WordPress with application passwords

> Let apps, automation tools and scripts use the WordPress REST API safely with application passwords, without sharing your login password.

Source: https://helpcenter.ruachost.com/wordpress/guides/connecting-apps-to-wordpress-with-application-passwords/

**Application passwords** let other apps and tools connect to your WordPress site through the **REST API**, for example to publish posts from an automation tool, sync products, or manage your site from a mobile app, without giving them your real password. Each app gets its own password, which you can revoke at any time.

## Before you start

- Your site must use **HTTPS**. See [Your free SSL certificate](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/how-to-install-ssl-certificate-on-your-site-using-lets-encrypt-ssl/).
- The REST API must be turned on. Security plugins sometimes turn it off. See [Enabling the REST API in WordPress](https://helpcenter.ruachost.com/wordpress/guides/enabling-the-rest-api-in-wordpress/).
- Use a WordPress user with only the role the app needs, for example **Editor** to publish posts, rather than an Administrator.

## Create an application password

1. In your WordPress dashboard, go to **Users → Profile** (or edit the user the app will use).
2. Scroll to **Application Passwords**.
3. Enter a name for the app, for example `n8n` or `Zapier`, and click **Add New Application Password**.
4. **Copy the password now.** It's shown only once, in groups of four characters. You can use it with or without the spaces.

## Use it

Apps ask for your **site address**, **username** and the **application password**. For your own scripts, use basic authentication:

```bash
# List your latest posts
curl -u "USERNAME:APPLICATION_PASSWORD" \
  https://example.com/wp-json/wp/v2/posts

# Create a draft post
curl -u "USERNAME:APPLICATION_PASSWORD" \
  -X POST https://example.com/wp-json/wp/v2/posts \
  -H "Content-Type: application/json" \
  -d '{"title":"Hello from the API","content":"Posted with an application password.","status":"draft"}'
```

See the [WordPress REST API handbook](https://developer.wordpress.org/rest-api/) for everything you can do.

## Revoke an application password

In **Users → Profile → Application Passwords**, click **Revoke** next to the app. It stops working immediately. Revoke passwords for apps you no longer use.

## Troubleshooting

- **"Application Passwords" section is missing:** your site isn't using HTTPS, or a security plugin has turned the feature off. Check the plugin's settings.
- **401 "Sorry, you are not allowed to…":** the user's role doesn't allow that action, or the password is wrong.
- **403 Forbidden:** a security plugin or firewall rule is blocking the request. See [Fixing 403 Forbidden errors](https://helpcenter.ruachost.com/getting-started/website-troubleshooting/fixing-403-forbidden-errors/).
- **Many requests are blocked with 429:** the app is sending requests too quickly. See [Fixing 429 "Too Many Requests" errors](https://helpcenter.ruachost.com/getting-started/website-troubleshooting/fixing-429-too-many-requests-errors/).

## Related articles

- [Administering WordPress from the command line (WP-CLI)](https://helpcenter.ruachost.com/wordpress/guides/administering-wordpress-from-the-command-line-wpcli/)
- [Using cPanel API tokens to automate your hosting](https://helpcenter.ruachost.com/cpanel/advanced/using-cpanel-api-tokens/)