Client Credentials

Example Request

Request examples use line breaks for the body content to make it easier to read. The authorization header is composed of a base64 encoded value for “client_id:client_secret“.

POST /?oauth=token HTTP/1.1

Headers
Authorization: Basic cXhaNmZDb09NajRjTks4U1hSSGE1bnVnNnZuc3dsRldTRjM3aHNXMzpMMWZ6TG9zSmY5VGx3bkNDVFo1cGtLbWRxcWtIU2hLRWkwZDRvRk5F
Content-Type: application/x-www-form-urlencoded

Body Request
grant_type=client_credentials


A successful response will contain the following.

{
  "access_token": "apvwxkbcxrnm9o92wmp4yjlbmoajeycfbn4ws6nx",
  "expires_in": 9087654,
  "token_type": "Bearer",
  "scope": "basic",
  "refresh_token": "z8wpp3pshgled4d81b4z8dmlc6ftwdscpgktyh7u"
}

Note:

Some servers running CGI can not process authorization headers. In this case, you can pass the parameters “client_id” and “client_secret” in the body request.

POST /?oauth=token HTTP/1.1

Headers
Content-Type: application/x-www-form-urlencoded

Body Request
grant_type=client_credentials
&client_id={client_id}
&client_secret={client_secret}

By default, any access token obtained using client credentials will no have a user assigned to it. This will result in an access token but not being able to use it to make authorized requests. If you do want to use a client id for client credentials, you should also create a WordPress user and assign it to the client in the editor. The user you create for the CLIENT ID should only have the capabilities you would like your application to have.