Give WordPress access with an application password
A more secure alternative for granting access to third-party apps or specific API integrations without sharing your main password.
- Time
- 3 minutes
- Difficulty
- Intermediate
- You’ll need
- An Administrator account on your WordPress site
Sometimes, we need to connect external software or a custom script to your WordPress website. Instead of giving that software your actual WordPress admin login and password, WordPress offers a brilliant, secure feature called Application Passwords.
Quick summary
An Application Password is a unique, randomly generated password that can only be used for API requests and integrations, not for logging into the WordPress dashboard. Go to Users → Your Profile, scroll down to Application Passwords, name it (e.g., "Chykalophia API"), and click Add Application Password. Share that generated password securely with us.
Why use an Application Password?
Application Passwords are an "Architect-level" security move. They are incredibly useful for integrations because:
- They are limited: They cannot be used to log into your actual
/wp-admindashboard screen. WordPress built them for software, not for people. - They are trackable: WordPress records when and from what IP address each application password was last used. The "Last Used" date is accurate to within a day, which is enough to spot a connection nobody is using any more.
- They are easily revokable: If an integration is no longer needed, you can revoke just that single application password without having to change your own main user password.
Step-by-step instructions
Any WordPress user can create an Application Password on their own profile, and it carries that account's permissions — so create ours from an Administrator account.
Log in to your website. Go to your WordPress login page and sign in.
Go to your profile. In the left-hand menu, hover over Users and click Your Profile.
Find the Application Passwords section. Scroll down near the bottom of your profile page until you see the section titled Application Passwords.
Name the password. In the "New Application Password Name" box, type
something descriptive so you remember what it's for. We recommend naming it
Chykalophia API or Chykalophia Integration.
Click Add Application Password. WordPress immediately generates a
24-character string of letters and numbers, displayed in groups of four so
it's easier to read (e.g., abcd EFGH ijkl MNOP qrst UVWX). Copy it exactly
as WordPress shows it.
Copy the password immediately. This is the only time WordPress will show you this password. Copy it to your clipboard.
Share it with us securely. Because this is a raw password string, do not email it in plain text. Please use a secure sharing link as outlined in our how to share a password safely guide.
Common questions
Does this replace adding support@chykalophia.com as an Admin?
No. We still need standard WordPress Admin Access to build pages, install plugins, and manage the site visually. Application Passwords are used exclusively when we need to connect a third-party tool (like a custom CRM or a headless app) directly to your site's code.
What do I do when you don't need this connection anymore?
To revoke it, go back to Users → Your Profile, scroll down to the Application Passwords list, find the one you named for us, and click the Revoke button next to it. The connection will instantly be severed.
I don't see the Application Passwords section in my Profile. Why?
The most common reason is that the site isn't being served over HTTPS. WordPress requires HTTPS for this feature, because the password would otherwise travel across the network in the clear. The other common reason is that your host, or a security plugin such as Wordfence or Kadence Security (formerly iThemes Security), has deliberately switched the feature or the WordPress REST API off. Let your project lead know, and we can help you sort out HTTPS or find a workaround.
Related guides
- Why we ask for access (and why it's safe)
- Delegate access vs. sharing a password
- How we keep your logins safe
- How to revoke our access later
- Access checklist for a new project
- Access directory (A–Z)
Need a hand?
Learn more
Last updated