Authentication for API in Wordpress - Step-by-Step Execution

Concept Flow - Authentication for API

Client sends API request

↓

Server checks for auth token

↓

Validate token

↓

Token valid?

Yes No↓

Process API

↓

Send response

The API receives a request, checks for an authentication token, validates it, and either processes the request or rejects it with an error.

Execution Sample

Wordpress

<?php
// Check for Bearer token
$headers = getallheaders();
if (!isset($headers['Authorization'])) {
  http_response_code(401); exit;
}
// Validate token
$token = str_replace('Bearer ', '', $headers['Authorization']);
if ($token !== 'valid_token') {
  http_response_code(403); exit;
}
// Process API request
http_response_code(200);
echo json_encode(['message' => 'Success']);

This PHP code snippet checks for a Bearer token in the request headers, validates it, and returns success or error codes accordingly.

Execution Table

Step	Action	Condition	Result	Response Code	Output
1	Receive API request	Authorization header present?	No	401	Exit with Unauthorized
2	Receive API request	Authorization header present?	Yes	N/A	Continue
3	Extract token	Token == 'valid_token'?	No	403	Exit with Forbidden
4	Extract token	Token == 'valid_token'?	Yes	200	Return Success message

💡 Execution stops when token is missing or invalid, sending 401 or 403 response respectively.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
$headers	empty	{Authorization: 'Bearer abc'}	{Authorization: 'Bearer abc'}	{Authorization: 'Bearer abc'}	{Authorization: 'Bearer abc'}
$token	undefined	undefined	'abc'	'abc'	'abc'
http_response_code	undefined	401 or N/A	403 or 200	403 or 200	200 or error code

Key Moments - 3 Insights

Why does the API return 401 Unauthorized instead of 403 Forbidden when the token is missing?

401 means the client did not provide authentication credentials (missing token), while 403 means credentials were provided but are invalid. See execution_table row 1 for missing token case.

What happens if the token is present but incorrect?

The API returns 403 Forbidden because the token is invalid. This is shown in execution_table row 3 where token validation fails.

Why do we remove 'Bearer ' from the Authorization header?

The Authorization header includes the word 'Bearer' followed by the token. We remove 'Bearer ' to get the actual token string to validate, as shown in the code sample.

Visual Quiz - 3 Questions

Look at the execution_table, what response code is sent when the Authorization header is missing?

A 200

B 403

C 401

D 500

💡 Hint

Check execution_table row 1 where Authorization header is missing.

At which step does the API send a 403 Forbidden response?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look at execution_table row 3 where token validation fails.

If the token is 'valid_token', what will be the final output?

A Success message with 200 code

B 403 Forbidden

C 401 Unauthorized

D No response

💡 Hint

See execution_table row 4 where token matches and response is 200.

Concept Snapshot

Authentication for API in WordPress:
- Check for 'Authorization' header in request
- Extract token by removing 'Bearer '
- If missing, send 401 Unauthorized
- If token invalid, send 403 Forbidden
- If valid, process request and send 200 with data
Use http_response_code() to set status codes.

Full Transcript

This visual execution shows how WordPress API authentication works. When a client sends a request, the server first checks if the Authorization header is present. If missing, it sends a 401 Unauthorized response and stops. If present, it extracts the token by removing the 'Bearer ' prefix. Then it checks if the token matches the expected valid token. If not, it sends a 403 Forbidden response. If the token is valid, the server processes the API request and returns a 200 OK response with a success message. This flow ensures only authenticated clients can access the API.