401 : Sorry, you are not allowed to create posts as this user

I have tried the same thing mentioned in it and I am getting below error message.

the account I am using is the Administrator and I have WP BASIC Auth (https://github.com/wokamoto/wp-basic-auth) plugin installed.

{
    "data": {
        "code": "rest_cannot_create",
        "message": "Sorry, you are not allowed to create posts as this user.",
        "data": {
            "status": 401
        }
    },
    "headers": {
        "Allow": "GET"
    },
    "status": 401
}

I am able to solve this problem. it was some misconfiguration in .htaccess file. I have installed "Application Passwords" plugin which indicated the problem in htaccess file.

For anyone else who encounters this problem, you need to install and activate the ‘Application Passwords’ plugin and then follow the instructions given here:
https://github.com/georgestephanis/application-passwords/wiki/Basic-Authorization-Header----Missing
But you don’t need to actually set up any Application Passwords for your users.

No amount of hacking the .htaccess file nor installing this plugin has the correct effect. Whenever I try to upload media with credentials that I know to be correct, I get "Sorry, you are not allowed to create posts as this user". This makes absolutely no sense as the user is me and I'm an admin.

@samdoj

I am getting the same problem, followed all the steps and its still failing to upload media with credentials that are correct. The error is same as @samdoj and it happens even with admin users.

{
"code": "rest_cannot_create",
"message": "Sorry, you are not allowed to create posts as this user.",
"data": {
"status": 401
}
}

i am unable to solve this issue please help

@samdoj

I am getting the same problem, followed all the steps and its still failing to upload media with credentials that are correct. The error is same as @samdoj and it happens even with admin users.

did you solve this ?

I spent hours facing the same problem and finally got it to work. The only plugin I installed was Application Passwords. I also edited the .htaccess file per the comments above. The issue I ran into was what username to use for the authorization header. I was trying to use the name assigned to the password generated through Application Passwords. In reality, you should use your actual username, which in my case is just "admin" (along with the password from Application Passwords).

I have the same issue and I cannot solve it with the free plan on wordpress.com as I cannot install plugins

This is a bug, it should just work and I shouldn't need to install plugins. Thanks

For anyone else who encounters this problem, you need to install and activate the ‘Application Passwords’ plugin and then follow the instructions given here:
https://github.com/georgestephanis/application-passwords/wiki/Basic-Authorization-Header----Missing
But you don’t need to actually set up any Application Passwords for your users.

This does the trick! Thank you.

The original suggestion didn't work for me (On Local by Flywheel)
This worked: https://wordpress.stackexchange.com/a/310898/90061

I was facing the same issue and the problem is, I forgot to add these lines in htaccess file.

RewriteCond %{HTTP:Authorization} ^(.)
RewriteRule ^(.) - [E=HTTP_AUTHORIZATION:%1]
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

You can also check below link to know how and where to add these lines.

https://github.com/imranhsayed/react-with-wordpress/

I had a similar problem, and my problem was that it used the "Application Passwords Name" as the username. And the normal username has to be used.

He also doubted whether to use the password with spaces or without spaces, finally it was with spaces.

I spent hours facing the same problem and finally got it to work. The only plugin I installed was Application Passwords. I also edited the .htaccess file per the comments above. The issue I ran into was what username to use for the authorization header. I was trying to use the name assigned to the password generated through Application Passwords. In reality, you should use your actual username, which in my case is just "admin" (along with the password from Application Passwords).

This is the actual answer here.

Same username, but generated Application Password.

go to .htaccess file and replace all below text

# BEGIN WordPress

RewriteEngine On
RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress

For folks that are still having issues even though their rules in .htaccess are correct: Does the username you are using have a space in it (eg: firstName lastName)? If so, create a new user with a username without a space (eg: firstNameLastName). This fixed the issue for me. Remotely connecting from another WordPress site was working fine for me but connecting from Power Automate was NOT until I used a username without a space. Hope this helps!

I resolved this by creating an Application Password From 'User' Menu

I resolved this by creating an Application Password From 'User' Menu

Thank you...

The problem stemmed from a permissions issue with the WP BASIC Auth plugin, despite using an Administrator account. After adjusting the necessary settings, the error Sorry, you are not allowed to upload this file type no longer occurs.

I spent hours facing the same problem and finally got it to work. The only plugin I installed was Application Passwords. I also edited the .htaccess file per the comments above. The issue I ran into was what username to use for the authorization header. I was trying to use the name assigned to the password generated through Application Passwords. In reality, you should use your actual username, which in my case is just "admin" (along with the password from Application Passwords).

We should push this to Top solution!!!

You should use Application password instead of your regular user password. For each user, you can create Application password on the user edit page.

I spent hours facing the same problem and finally got it to work. The only plugin I installed was Application Passwords. I also edited the .htaccess file per the comments above. The issue I ran into was what username to use for the authorization header. I was trying to use the name assigned to the password generated through Application Passwords. In reality, you should use your actual username, which in my case is just "admin" (along with the password from Application Passwords).

This worked for me. Use your actual username instead of application password name.

I spent waaaay too long on this so I made a PR to update the docs: WP-API/docs#207

Others have aluded to it but the username is some-user, not some-user@yoursite.com

Navigation Menu

Repository navigation

401 : Sorry, you are not allowed to create posts as this user #349

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

401 : Sorry, you are not allowed to create posts as this user #349

Description

Activity

jangirsuresh95 commented on Dec 20, 2017

richplastow commented on Mar 31, 2018

samdoj commented on Apr 4, 2018

ManishMuttreja1 commented on Mar 29, 2019

emmieandrew commented on Apr 19, 2019

emmieandrew commented on Apr 19, 2019

mattcullenmeyer commented on Apr 24, 2019

gotofritz commented on Jun 24, 2019

smartm0use commented on Dec 16, 2019

arunbasillal commented on Apr 9, 2020

geniecoder commented on Apr 12, 2020

iDanielBH commented on Apr 27, 2020

LukeV111 commented on Jun 25, 2020

kirankumarbiradar commented on Jun 16, 2023

BabcoxDeveloper commented on Feb 23, 2024

sagar03d commented on Apr 13, 2024

adjieguntoro-dev commented on Jun 12, 2024

rimi-web commented on Jun 28, 2024

shiyouben88 commented on Aug 28, 2024

ahmednabik commented on Jan 9, 2025

exceptionSPG commented on Sep 1, 2025

tobinbc commented on Sep 13, 2025

mpint commented on Oct 26, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions