WordPress Application Passwords: Create, Revoke, and Use with REST API

This article is a localized edition of the Japanese original. Read the Japanese original

Application passwords, added in WordPress 5.6, are dedicated passwords you give to the REST API and external tools. You don't have to share your real login password, you can issue one per tool, and you can revoke only the ones you no longer need. This article covers the requirements, how to create and delete them (admin screen, WP-CLI and PHP), how to use them with the REST API, and what to check when they don't work. The content was checked against the WordPress developer documentation and source code as of November 2026.

What application passwords can and can’t do

• They work for REST API and XML-RPC authentication. With the REST API, you send the username and application password using Basic authentication.
• They can't be used to log in to the admin area (wp-login.php). They are meant for programs and tools, not for people logging in.
• They carry the same permissions as the user who created them. If an administrator creates one, any tool holding it can do whatever an administrator can. If you only want a tool to post, create an Author or Editor user and issue the password as that user.
• You can revoke them one by one. The date and IP address of the last use are also recorded.

Requirements

By default, application passwords are available only on HTTPS sites or on sites whose environment type is local. WordPress decides this as follows (wp_is_application_passwords_supported()):

return is_ssl() || 'local' === wp_get_environment_type();

On a site still on HTTP, the section does not appear on the profile screen, because the password would be sent over an unencrypted connection.

Create one in the admin area

1. Open "Users → Profile" (for another user, edit that user from "Users → All Users").
2. In the "Application Passwords" section near the bottom, enter a name that shows the purpose (for example, Posting script, Zapier) in "New Application Password Name".
3. Click "Add Application Password" (in some versions it reads "Add New Application Password").
4. Copy the 24-character password that appears. Once you leave the screen, it is never shown again.

The password is displayed with a space every four characters, like abcd EFGH 1234 ijkl MNOP 6789, but authentication works with or without the spaces.

To revoke one, click the revoke button on its row in the same section. You can also revoke all of them at once with "Revoke all application passwords".

Create, list and delete with WP-CLI

# Create one (use --porcelain to print only the password)
wp user application-password create admin "Posting script" --porcelain

# List them (the uuid is used for deletion)
wp user application-password list admin --fields=uuid,name,created,last_used,last_ip

# Delete one
wp user application-password delete admin 6633824d-c1d7-4f79-9dd5-4586f734d69e

# Delete all of this user's application passwords
wp user application-password delete admin --all

For admin, you can give the username, email address or user ID. Replace the uuid with a value shown by list.

Create, list and delete with PHP

From a plugin or similar code, use the WP_Application_Passwords class.

<?php
$user_id = 2; // Target user ID

// Create one. On success it returns an array of [plain-text password, stored item]
$result = WP_Application_Passwords::create_new_application_password(
	$user_id,
	array( 'name' => 'Posting script' )
);

if ( is_wp_error( $result ) ) {
	error_log( $result->get_error_message() );
} else {
	list( $password, $item ) = $result;
	// $password is plain text. You can only get it now, so hand it to the user securely
	error_log( 'created: ' . $item['uuid'] );
}

// Get the list (name, uuid, created, last_used, last_ip and more)
foreach ( WP_Application_Passwords::get_user_application_passwords( $user_id ) as $item ) {
	error_log( $item['name'] . ' ' . $item['uuid'] );
}

// Delete one
// WP_Application_Passwords::delete_application_password( $user_id, $uuid );

Only a hashed value is stored, so the plain-text password can be retrieved only at the moment it is created.

Use it with the REST API

With curl, add Basic authentication with -u username:application-password. First, confirm that your own user information comes back as an authenticated user.

# Check authentication (success if your user information is returned)
curl -u "admin:abcd EFGH 1234 ijkl MNOP 6789" https://example.com/wp-json/wp/v2/users/me

# Create a draft post
curl -u "admin:abcd EFGH 1234 ijkl MNOP 6789" \
  -X POST https://example.com/wp-json/wp/v2/posts \
  -H "Content-Type: application/json" \
  -d '{"title":"Test post","content":"Body","status":"draft"}'

When calling another WordPress site's REST API from PHP, build the Authorization header yourself.

<?php
$response = wp_remote_get(
	'https://example.com/wp-json/wp/v2/users/me',
	array(
		'headers' => array(
			'Authorization' => 'Basic ' . base64_encode( 'admin:abcd EFGH 1234 ijkl MNOP 6789' ),
		),
	)
);

if ( ! is_wp_error( $response ) ) {
	error_log( wp_remote_retrieve_response_code( $response ) );
}

The password in the examples is a sample. Don't write real passwords directly in code; keep them somewhere that isn't public, such as environment variables or a config file.

What to check when authentication fails

REST API errors in general are covered in "How to fix REST API errors".

Disable application passwords

On sites that don't use them, you can turn the feature off entirely. Add this to your theme's functions.php or to your own plugin.

<?php
// Disable site-wide
add_filter( 'wp_is_application_passwords_available', '__return_false' );

To allow only certain users, use the per-user filter. The example below allows only users with administrator capability (manage_options).

<?php
add_filter( 'wp_is_application_passwords_available_for_user', function ( $available, $user ) {
	return $available && user_can( $user, 'manage_options' );
}, 10, 2 );

For restricting access to the REST API itself, see "How to restrict access to the REST API".

Operational tips

• Issue a separate password for each tool and name it so the purpose is clear. If one leaks, you can revoke just that tool's password.
• Revoke passwords for tools you no longer use right away. Entries whose last use is long ago in the list may no longer be in use.
• Reconsider whether you really need to give an administrator's password to an external service, and issue passwords from a user with only the permissions required.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)