Problem at posting using Application Password authentication

• 

  molympus · Member · Jul 20, 2026 at 9:49 am

  • Copy link
  • Add topic to favorites

  Hi, I have the WordPress.com Free Plan. I’m trying to know how to access, and modify post entries. Application Password authentication works.
  GET /posts/6757 returns HTTP 200.
  GET /posts/6757?fields=ID,title,capabilities returns:

  {

    “ID”:6757,

    “title”:”Wayne Pedzwater (bass)”,

    “capabilities”:{

       “publish_post”:false,

       “delete_post”:false,

       “edit_post”:false

    }

  }

  GET /posts/6757?context=edit returns:

  403 User cannot edit post

  POST /posts/6757 returns:

  403 User cannot edit post

  GET /me returns:

  403 authorization_required

  An active access token must be used…

  Does updating a post require OAuth2 instead of Application Password authentication? I’ve tried to know the answer through your IA assistant, but I don’t get a clear answer, so that’s why I ask here, for if you can help me. Thanks a lot in advance

  The blog I need help with is: (visible only to logged in users)

• 

  benitoalba · Member · Jul 21, 2026 at 8:37 pm

  • Copy link

  Hi there!

  Yes, requests that modify posts through public-api.wordpress.com require an OAuth2 access token. The Application Password is used only to obtain that token from /oauth2/token, it isn’t sent directly to the posts or /me endpoints.

  The HTTP 200 response doesn’t confirm authentication because published posts can be retrieved without logging in. That’s why the request returns edit_post: false, while context=edit, POST, and /me fail.

  For a personal script, follow the WordPress.com REST API authentication steps to exchange your username and Application Password for an access token. Then include this header with your requests:

  Authorization: Bearer YOUR_ACCESS_TOKEN

  The token must belong to a WordPress.com account that can edit post 6757. If the application will be used by other people, use the full OAuth2 authorization flow instead. Once /me works with the bearer token, you’ll know the request is authenticated and can then check any remaining role or post-permission issue.

• 

  molympus · Member · Jul 27, 2026 at 8:09 am

  • Copy link

  Thanks for all, I finally was able to perform the task I wanted to do, thanks to your explanation. Gracias, Benito!

• 

  benitoalba · Member · Jul 27, 2026 at 11:20 pm

  • Copy link

  Anytime, happy blogging!