The WordPress REST API opens your site to headless front ends, mobile apps, and external integrations. But every request that changes data needs authentication. Two approaches dominate: built-in Application Passwords and token-based JWT. Here’s how they compare and when to reach for each.
Application Passwords: Built In and Simple
Since WordPress 5.6, Application Passwords ship with core. A user generates a dedicated password for a specific app, separate from their login password, and revokes it any time without affecting their account.
How They Work
Requests use HTTP Basic Authentication over HTTPS, sending the username and application password with each call.
curl --user "ryan:xxxx xxxx xxxx xxxx" https://example.com/wp-json/wp/v2/postsWhen to Use Them
- Server-to-server integrations and cron tasks
- Internal automation where you control both ends
- Quick setups that don’t warrant extra plugins
They’re ideal because there’s nothing to install and credentials are easy to rotate. The trade-off: Basic Auth sends credentials on every request, so HTTPS is non-negotiable.
JWT: Token-Based and Stateless
JSON Web Tokens authenticate once, receive a signed token, then send that token on subsequent requests. A plugin issues the token after validating credentials, and the token carries an expiry.
How They Work
POST /wp-json/jwt-auth/v1/token
{ "username": "ryan", "password": "secret" }
// returns a token, then:
Authorization: Bearer eyJhbGciOi...When to Use Them
- Public-facing apps where users log in
- Headless front ends and single-page applications
- Cases where you want short-lived, expiring credentials
Security Considerations for Both
Whatever you choose, enforce HTTPS everywhere. Store secrets outside your codebase, ideally in environment variables, never committed to version control. Scope permissions to the minimum a given integration needs by using a dedicated user with a limited role.
Rotation and Revocation
Application Passwords can be revoked individually from the user profile. For JWT, keep expiry times short and implement refresh tokens so a leaked token has a limited blast radius.
Performance Notes
Application Passwords add no token round trip but re-authenticate every request. JWT authenticates once and then verifies a signature, which is fast, but you carry the cost of the initial token request and refresh logic. For high-volume server integrations, the difference is usually negligible.
Which Should You Choose?
For internal automation and server-to-server work, Application Passwords are the pragmatic default: no plugin, easy rotation, built into core. For user-facing apps and headless builds where people log in, JWT’s expiring tokens are the better fit. Many real projects use both.
Final Thoughts
Authentication is where REST API security lives or dies. Pick the method that matches your use case, enforce HTTPS, scope permissions tightly, and rotate credentials. Get those fundamentals right and the API becomes a safe, powerful extension of your WordPress site.