Authentication
This guide covers how to authenticate requests to the SportsPress REST API using Application Passwords and Postman.
GET requests (reading data) do not require authentication. Authentication is required for POST, PUT, PATCH, and DELETE operations.
Prerequisites:
A WordPress installation with SportsPress active
Administrator or Editor user account
Step 1 — Download and Install Postman
Visit https://www.postman.com/downloads/ and download the desktop application. Account creation is optional. After installation, open the app and either create an account or select "Skip and go to the app." Create a new request by clicking the [+] tab.
Step 2 — Generate an Application Password
Application Passwords are built into WordPress 5.6 and later. For older versions, install the Application Passwords plugin from https://wordpress.org/plugins/application-passwords/.
Go to Users in your WordPress admin.
Click your username to open the user profile.
Scroll to the Application Passwords section.
Enter a name for the password (e.g., "Postman" or "API Client").
Click Add New Application Password.
A modal displays the generated password — copy it immediately and store it securely. It will not be shown again.
Step 3 — Configure Basic Auth in Postman
Open your request in Postman.
Click the Authorization tab.
Set the Type to Basic Auth.
Enter your WordPress Username in the Username field.
Paste the Application Password generated in Step 2 into the Password field.
Step 4 — Set the Content-Type Header
For POST, PUT, and PATCH requests that send a JSON body, add the following header:
Key | Value |
|
|
Navigate to the Headers tab in Postman and add this key-value pair.
Step 5 — Send a Test Request
Test the authentication with a GET request that does not require auth to confirm connectivity:
GET https://example.com/wp-json/sportspress/v2/teams
Then test a write operation. For example, update a team:
PUT https://example.com/wp-json/sportspress/v2/teams/123
With a JSON body:
{
"title": "Updated Team Name"
}A 200 OK response with the updated object confirms authentication is working.
Authentication in Code
For server-side integrations, pass credentials via the Authorization header using Base64-encoded username:application_password:
$response = wp_remote_post(
'https://example.com/wp-json/sportspress/v2/events',
array(
'headers' => array(
'Authorization' => 'Basic ' . base64_encode( 'username:application-password' ),
'Content-Type' => 'application/json',
),
'body' => json_encode( array(
'title' => 'New Event',
'status' => 'publish',
) ),
)
);For JavaScript clients running in a browser, use cookie-based authentication with a nonce — see the WP REST API v2 Authentication guide for details.