{"id":617,"date":"2026-10-13T08:01:41","date_gmt":"2026-10-13T08:01:41","guid":{"rendered":"https:\/\/keyworth.co\/blog\/wordpress-api-publish-posts"},"modified":"2026-10-13T08:01:45","modified_gmt":"2026-10-13T08:01:45","slug":"wordpress-api-publish-posts","status":"publish","type":"post","link":"https:\/\/keyworth.co\/blog\/wordpress-api-publish-posts","title":{"rendered":"How to Publish WordPress Posts Programmatically with the REST API"},"content":{"rendered":"

To publish posts programmatically with the WordPress REST API, you send an authenticated POST request to the \/wp\/v2\/posts<\/code> endpoint. The request body, formatted as JSON, must include a title, content, and a status like ‘publish’, ‘draft’, or ‘future’. Authentication is best handled using Application Passwords for server-side scripts. This method allows for automating content workflows, scheduling posts, and integrating external content sources directly into your WordPress site, transforming content management from a manual task into a scalable, automated workflow.<\/p>\n

\"Close-up
Close-up of colorful code displayed on a computer screen within an editor window (Photo by Antonio Batini\u0107 on pexels)<\/span><\/figcaption><\/figure>\n

Understanding the WordPress REST API Fundamentals<\/h2>\n

The WordPress REST API is a developer-oriented interface for interacting with your site’s content. It provides a structured, predictable way to create, read, update, and delete WordPress content using standard HTTP methods. Instead of clicking buttons in the admin dashboard, you send requests to specific URLs, known as endpoints. The default route for the API is typically https:\/\/yourdomain.com\/wp-json\/wp\/v2\/<\/code>. All data is sent and received in JSON (JavaScript Object Notation), a lightweight and human-readable format. For anyone looking to automate content, the primary endpoint of interest is \/wp\/v2\/posts<\/code>. Sending a request to this URL is the programmatic equivalent of clicking “Add New Post”. The entire WordPress content model, from posts and pages to users and comments, is accessible through these endpoints, as detailed in the official REST API handbook. This direct access is what enables services to offer powerful features like direct publishing to WordPress blogs.<\/p>\n

Comparing Authentication Methods for API Access<\/h2>\n

Before you can create a post, you must prove to WordPress who you are. The API offers several ways to handle authentication, each suited for different scenarios. The choice of authentication method is a critical security decision that defines who can access your site and from where. While options like Basic Auth exist, they are not recommended for production environments due to security risks. For most programmatic publishing, Application Passwords<\/strong> are the modern, secure, and recommended standard. Third-party services might use OAuth 2.0, but this is often too complex for simple scripts. A detailed breakdown can be found within the WordPress developer resources on authentication<\/a>.<\/p>\n\n\n\n\n\n\n\n\n
Method<\/th>\nBest Use Case<\/th>\nPros<\/th>\nCons<\/th>\n<\/tr>\n<\/thead>\n
Application Passwords<\/td>\nServer-to-server scripts, cron jobs, CI\/CD pipelines<\/td>\nEasy to generate, built into WordPress Core (since 5.6), individually revocable.<\/td>\nTransmitted over HTTP (requires HTTPS), tied to a user account’s permissions.<\/td>\n<\/tr>\n
Basic Auth<\/td>\nLocal development testing ONLY<\/td>\nSimple to implement (username:password).<\/td>\nHighly insecure; sends credentials in plaintext with every request. Must not be used in production.<\/td>\n<\/tr>\n
JWT (JSON Web Tokens)<\/td>\nHeadless WordPress, Single Page Applications (SPAs)<\/td>\nStateless, can be used by client-side JavaScript, granular permissions.<\/td>\nRequires a dedicated plugin; adds complexity for token management and expiration.<\/td>\n<\/tr>\n
OAuth 2.0<\/td>\nThird-party applications needing user permission<\/td>\nIndustry standard for delegated authorization; users do not share credentials directly.<\/td>\nVery complex to implement; requires a plugin and a multi-step token exchange process. Overkill for internal scripts.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How to Create a New Post with a curl<\/code> Command<\/h2>\n

curl<\/code> is a command-line tool for transferring data with URLs. It’s the most direct way to test the WordPress REST API. To create a post, you’ll send a POST<\/code> request to the \/wp\/v2\/posts<\/code> endpoint. The request must include an Authorization<\/code> header and a JSON payload with the post’s data.<\/p>\n

First, you need an Application Password. Here is how to create one:<\/p>\n

    \n
  1. Log in to your WordPress admin dashboard.<\/li>\n
  2. Go to Users > Profile.<\/li>\n
  3. Scroll down to the “Application Passwords” section.<\/li>\n
  4. Enter a name for your new application (e.g., “My Publishing Script”) and click “Add New Application Password”.<\/li>\n
  5. WordPress will generate a password like abcd efgh ijkl mnop qrst uvwx<\/code>. Copy this immediately; it will not be shown again.<\/li>\n<\/ol>\n

    This password is used with your username for authentication. You’ll combine them as username:password<\/code> and Base64 encode them.<\/p>\n

    Here is a complete curl<\/code> example to create a new draft post:<\/p>\n

    Replace YOURBASE64<\/em>ENCODED_STRING<\/code> with your Base64-encoded username:password<\/code> string. A successful request will return a 201 Created<\/code> status code and the JSON object of the newly created post.<\/p>\n

    \"Computer
    Computer screen showing Python code and command line output for API authentication (Photo by \u0421\u0430\u0448\u0430 \u0410\u043b\u0430\u043b\u044b\u043a\u0438\u043d on pexels)<\/span><\/figcaption><\/figure>\n

    Publishing Posts with Python and JavaScript (Node.js)<\/h2>\n

    While curl<\/code> is great for testing, you’ll likely use a higher-level language for real automation. Python and JavaScript are popular choices.<\/p>\n

    Python Example using requests<\/code><\/h3>\n

    Python’s requests<\/code> library simplifies making HTTP requests. The process mirrors the curl<\/code> command: set headers, create the JSON payload, and send a POST request.<\/p>\n

    JavaScript (Node.js) Example using axios<\/code><\/h3>\n

    For Node.js environments, axios<\/code> is a common promise-based HTTP client. The logic is identical: prepare authentication headers and post the JSON data.<\/p>\n

    Managing Post Status, Scheduling, and Updates<\/h2>\n

    Programmatic publishing isn’t just about creating new posts; it’s about managing the entire content lifecycle. The REST API gives you full control over a post’s state.<\/p>\n

    The status<\/code> field in your JSON payload is the key. You can set it to:<\/p>\n