Wordpress REST API Auth Application Password Nonce Cookie

Definisi

WP REST API punya 3 cara auth: Cookie + nonce (request dari halaman WP sendiri, butuh X-WP-Nonce), Application Password (user generate di profile, Basic Auth via HTTPS), dan JWT/OAuth (plugin pihak ketiga). Tanpa auth, endpoint mutasi (POST/PUT) ditolak.

Kapan dipakai

Pakai Application Password untuk integrasi eksternal (mobile/app) via HTTPS. Pakai nonce+cookie untuk AJAX di dalam admin/front-end WP. Jangan pakai Basic Auth tanpa HTTPS (bocor).

Cara kerja

Application Password

bash

# header tiap request
curl -u "user:XXXX XXXX XXXX XXXX XXXX" https://site/wp-json/wp/v2/posts
# (Basic Auth over HTTPS)

Nonce (JS di WP)

js