Create new WordPress users from external signup forms via POST /wp/v2/users, assign roles with the roles field, and generate Application Passwords programmatically via POST /wp/v2/users/{id}/application-passwords. All operations require Administrator credentials — create_users and promote_users capabilities. Always use HTTPS; Application Password generation via API is powerful but dangerous if the admin credential is ever compromised.
| Fact | Value |
|---|---|
| Platform | WordPress |
| Rate limits | No core limit — managed hosts may block rapid user creation (keep below 10… |
| Difficulty | Intermediate |
| Time required | 60 minutes |
| Last updated | May 2026 |
API Quick Reference
No core limit — managed hosts may block rapid user creation (keep below 10 users/minute)
REST only
WordPress REST API User Management Overview
WordPress exposes full user lifecycle management through the /wp/v2/users endpoint. Administrators can create users, update roles, list team members, and — most powerfully — programmatically generate Application Passwords for API access. This enables automated user onboarding pipelines that connect external signup forms directly to WordPress without manual admin intervention.
https://yoursite.com/wp-json/wp/v2Setting Up Administrator Application Password Auth
- 1Log in to WordPress admin as an Administrator
- 2Navigate to Users → Your Profile
- 3Scroll to the Application Passwords section
- 4Enter a name like 'User Provisioning Bot' and click Add New Application Password
- 5Copy the 24-character password immediately — it's only shown once
- 6Strip spaces from the displayed password before encoding (spaces are display-only)
- 7Base64-encode 'admin_username:application_password' for the Authorization header
Key endpoints
/wp/v2/usersCreate a new WordPress user. Requires create_users capability (Administrator only).
/wp/v2/usersList users. Returns only public information for unauthenticated requests. Authenticated Administrators see all users.
/wp/v2/users/{id}Update an existing user's properties — role, email, display name, etc. Requires promote_users capability to change roles.
/wp/v2/users/{id}/application-passwordsGenerate a new Application Password for a user. Returns the password once — cannot be retrieved again. Requires Administrator.
Step-by-step automation
Set Up Admin Credentials
Why: User creation requires create_users capability, role assignment requires promote_users — both are Administrator-only. Using a lower-privilege account returns 403 on every operation.
Configure the admin credentials as environment variables and verify them before running any user management operations.
1export WP_BASE_URL="https://yoursite.com/wp-json/wp/v2"2export WP_ADMIN="admin_username"3export WP_ADMIN_PASSWORD="abcd1234efgh5678ijkl9012"45# Verify admin capabilities6curl -s \7 -H "Authorization: Basic $(echo -n "$WP_ADMIN:$WP_ADMIN_PASSWORD" | base64)" \8 "$WP_BASE_URL/users/me?_fields=id,name,capabilities" | python3 -m json.toolCreate a New User from Signup Form Data
Why: Automating user creation eliminates manual admin work and enables instant account activation for new subscribers, customers, or team members.
Create a user with role assignment. Check for duplicate username/email before creating to avoid the 400 existing_user_login error.
1# Create a subscriber-role user2curl -s -X POST \3 -H "Authorization: Basic $(echo -n "$WP_ADMIN:$WP_ADMIN_PASSWORD" | base64)" \4 -H "Content-Type: application/json" \5 -d '{6 "username": "johndoe",7 "email": "john@example.com",8 "password": "Secure!Pass#2026",9 "first_name": "John",10 "last_name": "Doe",11 "roles": ["subscriber"]12 }' \13 "$WP_BASE_URL/users"Generate an Application Password for the New User
Why: Programmatically generating Application Passwords enables automated onboarding flows where new users get API credentials without manual admin intervention.
After creating a user, generate an Application Password for them. Store the password immediately — it cannot be retrieved again via the API.
1# Generate an Application Password for user ID 422curl -s -X POST \3 -H "Authorization: Basic $(echo -n "$WP_ADMIN:$WP_ADMIN_PASSWORD" | base64)" \4 -H "Content-Type: application/json" \5 -d '{"name": "API Access - Onboarding"}' \6 "$WP_BASE_URL/users/42/application-passwords"Update User Role Programmatically
Why: Role changes (e.g., promoting a subscriber to contributor when they complete onboarding steps) should be automated rather than requiring manual admin action for each user.
Update a user's role via PUT. The roles field accepts an array — WordPress single-site supports one primary role per user. Providing multiple roles sets them all but may cause unexpected behavior on some themes and plugins.
1# Promote user ID 42 from subscriber to contributor2curl -s -X PUT \3 -H "Authorization: Basic $(echo -n "$WP_ADMIN:$WP_ADMIN_PASSWORD" | base64)" \4 -H "Content-Type: application/json" \5 -d '{"roles": ["contributor"]}' \6 "$WP_BASE_URL/users/42"Complete working code
Complete WordPress user onboarding automation. Accepts signup form data, creates the user with subscriber role, generates an Application Password, and returns credentials for the welcome email.
Error handling
The username is already taken. WordPress usernames must be unique and cannot be changed after creation.
Check for existing users with GET /wp/v2/users?search=username before attempting creation. Generate a fallback username (e.g., append a number) if the first choice is taken.
Another user account already uses this email address.
Always check for existing email before creating. Use GET /wp/v2/users?search=email@example.com to find existing accounts with that email.
The Application Password account lacks the create_users capability. Only Administrators can create new WordPress users.
Use an Administrator account's Application Password. Verify with GET /wp/v2/users/me and check the capabilities.create_users field.
Attempting to assign the administrator role from a non-admin account, or assigning roles without the promote_users capability.
Use an Administrator account. Also note: you cannot grant roles higher than your own — you cannot make another Administrator unless you are already an Administrator.
The user ID does not exist, was deleted, or you're on a multisite where the user is on a different site.
Verify the user ID with GET /wp/v2/users/{id} before updating. On multisite, users may need to be added to the specific site with add_user_to_blog.
Rate Limiting for WordPress User Management
| Scope | Limit | Window |
|---|---|---|
Security checklist
- Store admin Application Password in a secrets manager or environment variables — never in source code
- Use HTTPS for all API requests — Application Passwords do not work over plain HTTP (except localhost)
- Create a dedicated 'provisioning' administrator account with its own Application Password — not your personal admin
- Log all user creation events with timestamp, email, role, and source system for audit trails
- Rotate the admin Application Password monthly — revoke old ones from Users → Profile
- Send a secure password-reset link rather than transmitting the generated password in plaintext email
- Consider using a dedicated 'API only' admin account with a restricted display name to avoid confusing it with real users
- If generating Application Passwords for new users, transmit them over encrypted channels and prompt the user to generate a new one after first login
Automation use cases
Course Platform Member Sync
When a user purchases a course on Teachable, Thinkific, or Gumroad, automatically create a corresponding WordPress account with the appropriate role (subscriber, course_student) and send welcome credentials.
Membership Site Onboarding
Connect Stripe subscriptions to WordPress accounts. When a subscription activates, create/upgrade the user role. When it cancels, downgrade back to subscriber.
Team Member Provisioning
Sync staff from an HR system (BambooHR, Workday) to WordPress. New hires get WordPress contributor accounts; departures are downgraded to subscriber or deleted.
API Client Registration
Build a self-service API portal where developers register and automatically receive WordPress Application Passwords scoped to their use case.
Best practices
- Always check for existing username and email before creating a user — 400 errors on duplicates are common and preventable
- Use subscriber role as the default for new users — grant higher roles only when explicitly earned or purchased
- Generate strong random passwords for new accounts and send a password reset link in the welcome email rather than the password itself
- Store Application Passwords generated for users in your own database — you cannot retrieve them from WordPress after the initial response
- Never grant the administrator role via automation without additional verification steps — one compromised webhook can grant admin access to attackers
- On multisite installations, remember that creating a user at the network level does not add them to individual sites — use the site-specific endpoint or wp_add_user_to_blog
- Keep user creation operations below 10 per minute to avoid triggering host-level brute-force protection
Ask AI to help
Copy one of these prompts to get a personalized, working implementation.
I'm building a WordPress user provisioning automation using the REST API. It needs to create new subscriber accounts from Stripe webhook data (new subscription events), check for duplicate emails, generate Application Passwords for each new user, and return credentials for a welcome email. Using Application Password auth (Administrator role). Can you help me add proper error handling for the existing_user_login and existing_user_email 400 errors, plus retry logic for the host's rate limiting?
Frequently asked questions
Can I create WordPress users without Admin access?
No. Creating users requires the create_users capability, which only Administrators have. Editor, Author, Contributor, and Subscriber roles cannot create users via the REST API and will receive 403 rest_cannot_create_user.
Can I retrieve an Application Password after generating it?
No. The password value is only returned once in the POST response. WordPress stores a hashed version and cannot recover the plaintext. If you lose it, delete the old one with DELETE /wp/v2/users/{id}/application-passwords/{uuid} and generate a new one.
What roles are available in WordPress?
Default WordPress roles are: subscriber (read only), contributor (write draft posts), author (publish own posts), editor (publish all posts, manage comments), and administrator (full site control). Custom roles added by plugins (e.g., shop_manager from WooCommerce) are also assignable via the API.
How do I delete a WordPress user via the API?
Use DELETE /wp/v2/users/{id}?force=true&reassign={other_user_id}. The force=true parameter is required (soft delete is not supported). The reassign parameter specifies which user should inherit the deleted user's posts — omitting it deletes all their posts too.
Can I create users on a WordPress multisite network?
Yes, but behavior differs. POST /wp/v2/users creates a user at the site level on single-site. On multisite, users exist at the network level — creating via the API may or may not add them to the specific site depending on your configuration. Super Admin operations require wp-login.php access or the network-admin REST routes.
Is it safe to auto-generate Application Passwords for new users?
It's powerful but risky if your admin credential is compromised. An attacker with your admin Application Password could generate API access for any user. Mitigate this by: storing the admin credential in a secrets manager, rotating it monthly, using a dedicated provisioning admin account, and logging all Application Password generation events.
Can RapidDev help with a more complex user provisioning pipeline?
Yes. RapidDev builds custom WordPress automation pipelines that connect membership platforms (Stripe, Teachable, Memberful) to WordPress user management, including role-based access control, automated credential emails, and audit logging. The basic pattern in this guide is a solid foundation, but production systems usually need error handling for network failures, idempotency keys, and monitoring.
Need this automated?
Our team has built 600+ apps with API automations. We can build this for you.
Book a free consultation