WordPress REST API authentication breaks three different ways
WordPress REST API authentication breaks three different ways
Tokens, cookies, and nonces each authenticate WordPress REST API requests—and each fails in ways that cost you hours of debugging.
The API request worked yesterday. Same endpoint, same headers, same payload—but this morning it returns 401 Unauthorized and your automation workflow stops cold. You’re staring at three authentication methods in the WordPress REST API documentation, and none of them explain why your cron job suddenly can’t talk to your own site.
WordPress offers tokens, cookies, and nonces for REST API authentication. Each one works differently, expires on its own schedule, and breaks your workflow in ways the docs don’t warn you about. Here’s what actually happens when you pick the wrong method—and how to fix it before your next deployment.
In today's email:
- Application passwords authenticate server-to-server—but expire silently
- Cookie authentication only works when browser sessions are live
- Nonces expire after 24 hours and block automation