Connecting apps to WordPress with application passwords

Application passwords let other apps and tools connect to your WordPress site through the REST API, for example to publish posts from an automation tool, sync products, or manage your site from a mobile app, without giving them your real password. Each app gets its own password, which you can revoke at any time.

Before you start

Your site must use HTTPS. See Your free SSL certificate.
The REST API must be turned on. Security plugins sometimes turn it off. See Enabling the REST API in WordPress.
Use a WordPress user with only the role the app needs, for example Editor to publish posts, rather than an Administrator.

Create an application password

In your WordPress dashboard, go to Users → Profile (or edit the user the app will use).
Scroll to Application Passwords.
Enter a name for the app, for example n8n or Zapier, and click Add New Application Password.
Copy the password now. It’s shown only once, in groups of four characters. You can use it with or without the spaces.

Use it

Apps ask for your site address, username and the application password. For your own scripts, use basic authentication:

# List your latest posts
curl -u "USERNAME:APPLICATION_PASSWORD" \
  https://example.com/wp-json/wp/v2/posts

# Create a draft post
curl -u "USERNAME:APPLICATION_PASSWORD" \
  -X POST https://example.com/wp-json/wp/v2/posts \
  -H "Content-Type: application/json" \
  -d '{"title":"Hello from the API","content":"Posted with an application password.","status":"draft"}'

See the WordPress REST API handbook for everything you can do.

Revoke an application password

In Users → Profile → Application Passwords, click Revoke next to the app. It stops working immediately. Revoke passwords for apps you no longer use.

Troubleshooting

“Application Passwords” section is missing: your site isn’t using HTTPS, or a security plugin has turned the feature off. Check the plugin’s settings.
401 “Sorry, you are not allowed to…”: the user’s role doesn’t allow that action, or the password is wrong.
403 Forbidden: a security plugin or firewall rule is blocking the request. See Fixing 403 Forbidden errors.
Many requests are blocked with 429: the app is sending requests too quickly. See Fixing 429 “Too Many Requests” errors.

Was this page helpful?