WordPress REST API Getting Started: Quickstart Guide (2026)

The WordPress REST API is a core feature of WordPress, providing an interface for applications to interact with a WordPress site by sending and receiving JSON data. This guide outlines the foundational steps to begin using the API, from initial setup to making your first authenticated request.

Getting started overview

To begin working with the WordPress REST API, a WordPress installation is required. The API is active by default on WordPress versions 4.7 and later. Interaction with the API involves sending HTTP requests to specific endpoints and processing the JSON responses. Most operations, particularly those that modify data, require authentication.

The initial setup process typically includes:

1. Ensuring WordPress is installed and updated: The REST API is built into WordPress core, so an operational WordPress site is fundamental.
2. Identifying your API base URL: This is generally your site's URL followed by /wp-json/.
3. Setting up authentication: For most write operations and access to private data, authentication is necessary. Application Passwords are the recommended method for server-to-server or single-user integrations.
4. Making your first API request: Verifying connectivity and basic functionality with a simple GET request.

This quick-reference table summarizes the key steps:

Create an account and get keys

To use the WordPress REST API, an active WordPress installation is required. There is no separate API account or registration process beyond setting up your WordPress site. For authenticated requests, particularly those that create, update, or delete content, you will need to generate Application Passwords.

Setting up Application Passwords

Application Passwords provide a secure way to authenticate with the API without exposing your primary user password. This feature was introduced in WordPress 5.6 and is the recommended method for most integrations for API authentication.

1. Log in to your WordPress Admin Dashboard: Access your site's administrative area.
2. Navigate to your Profile: Go to Users > Profile from the left-hand menu.
3. Locate Application Passwords: Scroll down to the "Application Passwords" section.
4. Create a New Application Password: Enter a descriptive name for your new application password (e.g., "My Mobile App Integration" or "Data Sync Script") in the "New Application Password Name" field and click the "Add New Application Password" button.
5. Copy the Password: WordPress will generate and display a unique password. This password will only be shown once, so copy it immediately and store it securely. Treat this password like a regular user password.

This generated password will be used with Basic Authentication for your API requests. The username associated with this password will be the WordPress user under which you generated it.

For more complex scenarios, such as third-party applications or services that require user authorization without direct sharing of credentials, the OAuth 2.0 framework is commonly used. While WordPress doesn't include a robust OAuth 2.0 server out-of-the-box, plugins are available to provide this functionality, such as the OAuth 1.0a Server plugin for WordPress, which supports the older OAuth 1.0a specification.

Your first request

Once you have your WordPress site running and, if needed, an Application Password, you can make your first API request. We'll start with a simple, unauthenticated GET request to retrieve public posts, and then demonstrate an authenticated request.

Unauthenticated Request (Get Posts)

The most basic request is to retrieve a list of public posts. This does not require any authentication.

Endpoint: https://your-wordpress-site.com/wp-json/wp/v2/posts

Using cURL:

curl -X GET "https://your-wordpress-site.com/wp-json/wp/v2/posts"

Replace https://your-wordpress-site.com with the actual URL of your WordPress installation. The response will be a JSON array of post objects.

Authenticated Request (Create a Post)

To create a new post, you'll need to use Basic Authentication with the Application Password you generated. The request will be a POST request to the same posts endpoint, including the Authorization header.

Endpoint: https://your-wordpress-site.com/wp-json/wp/v2/posts

HTTP Method: POST

Headers:

• Content-Type: application/json
• Authorization: Basic <base64_encoded_username:application_password>

To create the Authorization header value, you need to base64 encode your WordPress username and the application password, separated by a colon. For example, if your username is johndoe and your application password is abcd efgh ijkl mnop qrst uvwx, you would encode johndoe:abcd efgh ijkl mnop qrst uvwx.

Using cURL:

curl -X POST "https://your-wordpress-site.com/wp-json/wp/v2/posts" \ 
     -H "Content-Type: application/json" \ 
     -H "Authorization: Basic <base64_encoded_username:application_password>" \ 
     -d '{"title": "My New API Post", "content": "This post was created via the WordPress REST API.", "status": "publish"}'

Remember to replace the placeholder URL and the Authorization header with your actual values. A successful request will return a JSON object representing the newly created post, including its ID and other details.

Common next steps

After successfully making your first requests, consider these common next steps to further explore and integrate with the WordPress REST API:

• Explore More Endpoints: The WordPress REST API offers a wide range of endpoints for managing categories, tags, users, media, and more. Review the official documentation to understand the available resources.
• Learn About Parameters: Many endpoints support query parameters for filtering, sorting, and pagination. For example, you can retrieve posts by category, author, or search term.
• Error Handling: Implement error handling in your application to gracefully manage API responses that indicate errors, such as invalid authentication or bad requests.
• Security Best Practices: For production applications, always use HTTPS for all API interactions. Securely store your Application Passwords or implement a more robust OAuth flow if necessary. Consider rate limiting and input validation for any data sent to the API.
• Custom Endpoints: If the default endpoints do not meet your specific requirements, you can register custom REST API endpoints within a WordPress plugin or theme. This allows you to expose custom data or functionality via the API.
• Client Libraries: While WordPress does not provide official SDKs, various community-maintained client libraries exist for popular programming languages (e.g., JavaScript, PHP, Python). These libraries can simplify API interactions by abstracting HTTP requests.
• Webhooks: For real-time updates, consider using webhooks, which can notify your application when certain events occur on your WordPress site (e.g., a new post is published). While not a native WordPress REST API feature, plugins can add webhook functionality.

Troubleshooting the first call

Encountering issues during your first API call is not uncommon. Here are some common problems and their solutions:

• 404 Not Found Error:
  • Permalinks: Ensure your WordPress permalinks are not set to "Plain." Navigate to Settings > Permalinks in your WordPress admin and choose a structure other than "Plain" (e.g., "Post name"). Save changes. This is crucial for the /wp-json/ endpoint to be correctly routed.
  • Site URL: Verify that your site URL in the API request matches your WordPress installation's actual URL.
  • Server Configuration: On some servers, especially those using Nginx, additional configuration might be needed to ensure the .htaccess rules (for Apache) or equivalent rewrite rules for the REST API are correctly processed. Refer to your hosting provider's documentation or the Nginx WordPress configuration guide.
• 401 Unauthorized Error:
  • Incorrect Application Password: Double-check that the Application Password you copied is correct and hasn't had extra spaces or characters added. Remember to base64 encode the username and password correctly.
  • User Permissions: Ensure the WordPress user associated with the Application Password has the necessary capabilities to perform the desired action (e.g., 'edit_posts' to create a post).
  • HTTPS Requirement: Application Passwords, by default, require HTTPS. If your site is not running over HTTPS, you might encounter issues. Consider setting up SSL/TLS for your domain.
• 403 Forbidden Error:
  • Insufficient Permissions: This typically indicates that the authenticated user does not have the necessary permissions for the requested action or resource. Verify the user's role and capabilities in WordPress.
  • Security Plugins: Some WordPress security plugins can block REST API requests. Temporarily disable security plugins to test if they are interfering, then reconfigure them to allow API access.
  • Firewall/WAF: Your hosting provider's firewall or a Web Application Firewall (WAF) might be blocking requests. Check server logs or contact support.
• CORS Issues (Cross-Origin Resource Sharing): If you are making requests from a different domain (e.g., a JavaScript frontend), you might encounter CORS errors. WordPress does not enable CORS by default for all origins. You may need to add CORS headers to your server configuration or use a WordPress plugin that manages CORS.

Always review the WordPress debug logs and your web server's error logs for more specific messages, which can help pinpoint the exact cause of an issue.