Authentication

Influenzic’s REST API uses WordPress Application Passwords for authentication. This is the recommended approach for server-to-server integrations and custom frontends.

Base URL

https://yourdomain.com/wp-json/influenzic/v1/

Creating an Application Password

1. 1
   In WordPress admin, go to Users → Profile (or edit any user).
2. 2
   Scroll to the Application Passwords section.
3. 3
   Enter a name for the application (e.g. “My Custom Frontend”) and click Add New Application Password.
4. 4
   Copy the generated password immediately — it is only shown once.

Making Authenticated Requests

Use HTTP Basic Auth with the WordPress username and the application password (including the spaces in the generated password).

cURL Example

curl -X GET "https://yourdomain.com/wp-json/influenzic/v1/campaigns" 
  -u "api_user:XXXX XXXX XXXX XXXX XXXX XXXX" 
  -H "Content-Type: application/json"

JavaScript (fetch) Example

const response = await fetch(
    'https://yourdomain.com/wp-json/influenzic/v1/campaigns',
    {
        headers: {
            'Authorization': 'Basic ' + btoa( 'api_user:XXXX XXXX XXXX XXXX XXXX XXXX' ),
            'Content-Type':  'application/json',
        },
    }
);
const data = await response.json();

Troubleshooting: 401 Unauthorized / rest_cannot_access

The most common issue when working with the WordPress REST API in shared hosting environments is that Apache or CGI/FastCGI configurations strip out the Authorization header from HTTP requests. When this happens, WordPress does not see the credentials and rejects the request as unauthorized.

Solution: Update `.htaccess` (Apache)

If you are using Apache hosting (e.g. cPanel or standard Linux VPS), open your site’s root .htaccess file and add the following lines at the top, immediately after RewriteEngine On:

RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

This rule catches the raw incoming HTTP Authorization header and forces Apache to pass it directly through to the PHP process as a server environment variable.

Solution: Nginx Configuration

If you are using Nginx, ensure the FastCGI configuration includes passing headers. By default, Nginx passes all headers containing alphanumeric characters and hyphens, but verify that your fastcgi_params file contains:

fastcgi_param HTTP_AUTHORIZATION $http_authorization;

Response Format

All endpoints return JSON. Successful responses follow this structure:

{
    "success": true,
    "data": { ... },
    "meta": {
        "total": 42,
        "page": 1,
        "per_page": 20
    }
}

Error responses:

{
    "success": false,
    "code": "rest_forbidden",
    "message": "You do not have permission to access this resource.",
    "status": 403
}