Using app passwords or Rest Api with 2fa

  • Resolved swporg

    (@swporg)


    9 months, 2 weeks ago

    Hello,

    we are using the plugin for 2fa but have one question. If we set up the 2fa then you cant use app passwords for the user, and when trying to use a JWT plugin for the api it will give an “invalid api credentials for user” error message when trying to hit the endpoint. Is there a way around this? Do you have a setting to exclude the api from the 2fa? Is this something you offer in premium vs free? 
    Or how would you be able to use the api in external apps while using the 2fa on the login.
    Thank you

Viewing 1 replies (of 1 total)
  • Plugin Support Lucian Padureanu

    (@lucianwpwhite)

    9 months, 2 weeks ago

    Hello @swporg !

    Thank you for reaching out!

    I got a few questions just to get a better overview of what you are trying to achieve, and how:

    1. Which JWT plugin are you using, and what endpoint are you calling exactly when encountering this error?
    2. Just to make sure I understand correctly: when you mention “exclude the API” and “app password,” are you referring to excluding certain REST API routes from 2FA enforcement, or are you asking if WP 2FA disables the built-in WordPress Application Passwords feature when 2FA is enabled?
    3. Can you share a sanitized example request and full response JSON, including headers so we can see how you are performing these actions? Make sure to censor any sensitive or compromising site info from the screenshot.
    4. Are WordPress Application Passwords enabled for the affected user?
    5. Is REST enabled on the site or just partially enabled? Can you elaborate on any limitations or setup particularities?
    6. Is the user being enforced for 2FA via role or policy, or are any user-level exclusions applied?
    7. Is the site using HTTPS in production, and are you behind any WAF or reverse proxy that could alter auth headers?

    For reference, we do have an article related to the new REST endpoints we have included in the most recent update, which can be accessed here – leaving this here just in case you haven’t already checked it.

    Once we have more context on what and how you are trying to achieve, I will try to offer some guidance.

    Looking forward to your response.

Viewing 1 replies (of 1 total)

The topic ‘Using app passwords or Rest Api with 2fa’ is closed to new replies.