Using WordPress Application Passwords (REST API)

In the WordPress menu, if you look at the ‘Users > Profile‘ page, there is an item called ‘Application Passwords‘.

When a specific user needs to access WordPress through an external program to write or edit posts, the purpose is to create an authentication system that requires verifying a password set in advance. I thought I wouldn’t have a use for it, but recently, while studying ‘automation of work’, I found a need to use it. I will summarize how to use WordPress application passwords by calling it in the Make.com automation process as an example.

Password Generation

Define a name for identification and click the ‘Add New Application Password’ button.

Then, the password will be displayed as shown below. This password is displayed only once, and there is no way to confirm it afterward, so you must copy it somewhere before proceeding to the next step.

You can only see the creation date as shown below, and the list will be displayed in a form where you can only discard it.

BASE64 Encoding

Now, encode the string that connects the username and the generated password. If the user ID at the time of password creation is ‘admin’ and the password is ‘abcd efgh ijkl mnop’, you should encode the string below.

admin:abcd efgh ijkl mnop

It seems you need to know a bit of programming to encode, but if you request ChatGPT as below, it will do it for you right away.

Please base64 encode the following.
admin:abcd efgh ijkl mnop

The encoded string will be displayed in the form below.

YWRtaW46YWJjZCBlZmdoIGlqa2wgbW5vcA==

Utilization of Password (Encoded String)

In my case, I needed it to call WordPress via the HTTP module on Make.com to create a post.

Although there is a separate module prepared for writing and editing WordPress posts in the Make modules, if you want to input other values (e.g., Custom Taxonomy) that are not provided as default items such as title/content/category/post meta, you can also use the method of calling WordPress’s API through the HTTP module to instruct the necessary tasks.

The image below captures part of the screen where I want to modify the Custom Taxonomy of an existing post. By recording “Authorization: Basic encoded password” in the header section, you will pass the pre-authorized password when calling the WordPress API.

Of course, there are other methods besides Basic authentication, but this should suffice for my purposes.