401 Error in WP Rest API (Basic Auth and OAuth)

Question

I'm building a mobile app for a WP site and I'm trying to get POST requests to the WP-API working, starting with users.

I'm following the process outlined in a few tutorials:

1. Install Basic Auth plugin
2. In Postman, prepare a request to POST wp-json/wp/v2/users, filling in credentials for my admin user, using Basic Auth, in the authentication tab.
3. In the body, include a username, email, and password.

(nothing else, no other headers or anything)

And I get a 401 error:

{
    "code": "rest_cannot_create_user",
    "message": "Sorry, you are not allowed to create new users.",
    "data": {
        "status": 401
    }
}

A questions here mention cookies and being signed in or out in the browser; I get the same result whether or not I'm signed in to my WP Admin console in Chrome. I'm using the Postman desktop client.

(I'm off to try to figure out oAuth or JWT, but still perplexed why this more basic route isn't working!)

UPDATE

I've followed these steps from an OAuth tutorial and gotten the same 401 response (after attempting a DELETE request)

1. Install and activate OAuth1 plugin
2. Register a new application, to get client key and client secret. (Pointing the callback url to a simple placeholder file I put on my server)
3. POST /oauth1/request with step 2's key and secret as oauth_consumer_key and oauth_consumer_secret (oauth_signature_method = HMAC-SHA1), passed as auth headers. Receive oauth_token and oauth_secret.
4. Visit http://my-dev-server.com/oauth1/authorize?oauth_token=<token_here>&oauth_token_secret=<secret_here> in my browser, with oauth_token and oauth_secret from step 3.
5. Brought to the WP connect page (logged in as the admin for the site), click Authorize. Receive verification token.
6. POST /oauth1/access, with oauth_consumer_key and oauth_consumer_secret used in step 3 and oauth_token and oauth_secret received in step 3 as auth headers, and with the verification token from step 5 as query in URL oauth_verifier (http://my-dev-server/oauth1/access?oauth_verifier=<oauth_verifier_value>). receive new oauth_token and oauth_secret.
7. DELETE /wp-json/wp/v2/job-listings/936 (the id of a listing I just created, from the website, to be deleted) using the original oauth_consumer_key and oauth_consumer_secret and the new oauth_token and oauth_secret (received in step 6) as auth headers.

And then I get the 401 response. Note, of course, that all intermediate steps appear to have worked correctly. I never replaced my placeholder callback, but the tutorial didn't say anything about that. But maybe that's my problem?

I'll also note that I haven't done any server setup to expose positing to the API. None of these tutorials, as far as I can tell, mention any pre-work like this so I assumed it would just work out of the box. (someone else designed the WP site and picked all the database plugins etc).

Answer 1

Please try with this URL: POST wp-json/wp/v2/users/me