Authentication for API in Wordpress - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of authentication in an API?

Authentication ensures that only authorized users or systems can access the API, protecting data and functionality from unauthorized use.

intermediate

Name two common authentication methods used in WordPress APIs.

1. Cookie Authentication (used mainly for logged-in users in WordPress).<br>2. Application Passwords (a simple way to authenticate external apps).<br>3. OAuth (for more secure, token-based authentication).

intermediate

How does Application Password authentication work in WordPress REST API?

Application Passwords allow external apps to authenticate by sending a username and a special password in the request header. This password is different from the user’s main password and can be revoked anytime.

advanced

What is OAuth and why is it used for API authentication?

OAuth is a secure token-based authentication method that lets users grant limited access to their resources without sharing passwords. It is used to improve security and user control over API access.

beginner

Why should API authentication always use HTTPS?

HTTPS encrypts data sent between client and server, protecting sensitive information like passwords or tokens from being intercepted by attackers.

Which WordPress API authentication method uses a special password different from the user’s main password?

A OAuth

B Cookie Authentication

C Basic Authentication

D Application Passwords

Application Passwords are special passwords created for external apps and are different from the user's main password.

What does OAuth primarily provide for API authentication?

A Token-based access without sharing passwords

B Simple username and password login

C Encryption of data in transit

D Automatic user registration

OAuth allows users to grant access via tokens without sharing their passwords.

Why is HTTPS important for API authentication?

A It encrypts data to prevent interception

B It speeds up API responses

C It allows anonymous access

D It stores passwords securely

HTTPS encrypts data sent between client and server, protecting sensitive information.

Which authentication method is mainly used for logged-in WordPress users accessing the REST API?

A Application Passwords

B OAuth

C Cookie Authentication

D API Keys

Cookie Authentication uses the logged-in user's session cookies to authenticate API requests.

What is a key benefit of using Application Passwords over regular user passwords?

A They never expire

B They can be revoked without changing the main password

C They allow anonymous API access

D They are stored in plain text

Application Passwords can be revoked individually without affecting the user's main password.

Explain how authentication protects a WordPress API and describe two common methods used.

Think about who can use the API and how WordPress checks their identity.

Describe why HTTPS is essential when using authentication for APIs and what risks it helps prevent.

Consider what happens if data is sent without encryption.