Custom WP-API Authentication

The WP-API is a JSON REST API that is slated to go into WordPress core. The API allows applications like mobile apps to interact with WordPress.

It’s been written about extensively, and it’s documented well. If you’ve worked with the API before, you may have come across the issue of authentication.

The API can allow you to create a post, get information about users, and lots more. For that reason, it has to make sure you are allowed to do that. The process for figuring out who can do these things is called authentication, and it can be a pain.

The documentation on authentication is sparse, with options for cookie, oauth, or basic authentication. In this post I will show you how to create your own custom authentication.

Note: the WP-API is going through some major changes before it goes into WordPress core, so this process may change.

Let’s say I made a mobile app where a user can take a photo and upload it to their own WordPress site. The mobile app user would need to login first, then we need to tell the API that they are authenticated. How do we do that?

I’m going to show you how to make a custom authentication filter for this use-case. Disclaimer: I’m not a security expert, so it’s up to you to make sure whatever authentication you use is secure.

Using a custom filter

There is a filter called json_authentication_errors that allows you to return a boolean value to authenticate an API request.

This is a custom plugin you have to create and activate on your WordPress site, assuming you also have the WP-API plugin active. The code looks like this:

function checkApiAuth( $result ){
    
    // Check if user is allowed to do stuff here
    
    if($user_checks_out) {
        $result = true;
    } else {
        $result = false;
    }

    return $result;
            
}
add_filter('json_authentication_errors', 'checkApiAuth');

With this plugin active on your site, anytime it returns true the user will be able to post to your site, get user information, post meta, and more. If it returns false, they will only be able to do the actions that don’t require authentication, such as getting a list of posts.

One example of how this could work in our app is to verify a token for a user. Let’s say when a user logs into your app, a token is set in the app and in the user meta. In our API filter, we can check if the token in the app matches the token in the user meta.

That would look like this:

function checkApiAuth( $result ){
    
    // if user and token from app match user meta in wp, continue
    
    $app_token = $_GET['app_token'];
    
    $user_id = $check_user_id;
    
    $wp_token = get_user_meta( $user_id, 'app_token', true);

    if( empty( $app_token ) )
        $result = false;
        
    if( $wp_token === $app_token )
        $result = true;

    return $result;
            
}
add_filter('json_authentication_errors', 'checkApiAuth');

In this case, we would send the app_token along with each API request, which looks like this:

https://mysite.com/wp-json/posts?app_token=13353409ufdhls

Our custom filter checks if the app_token matches the token stored in the user meta. You’d also have to be sending along the user id, so we know which user meta to check. I did not include that in the code above, because it wouldn’t be secure to send both the user id and the token in every request.

Security

This is just an example, and it’s probably not the most secure way to interact with the API. You need to make sure your token cannot be intercepted and used maliciously.

The authentication methods recommended in the WP-API docs such as oAuth are probably a better way to go for a production app. However, for a simple app a custom authentication method may work just fine, as long as you harden the security as much as possible.