Connect a WordPress site with an Application Password.

/ Overview

What an Application Password is

An Application Password is a password WordPress issues to one outside application. It does not replace your login password: it only works against the REST API and cannot be used to sign in to the admin area. You can create as many as you like, each with its own name, and revoke them one by one.

• Do not use your login password. Your login password opens the whole admin area and usually sits behind two-factor authentication, so WordPress does not accept it for the REST API. Application Passwords exist for exactly this job.
• WordPress 5.6 or newer, over HTTPS. The feature ships with WordPress 5.6 — no plugin needed. WordPress only shows the Application Passwords section when the site is served over https://.
• The account needs publishing rights. Use an account with the Author, Editor or Administrator role. Subscriber and Contributor accounts cannot publish, so a channel connected with one cannot publish either.

/ In WordPress

Creating it in WordPress

Five steps, all inside your own WordPress admin:

• 1

  Sign in as the account that will publish. An Application Password belongs to one user. Posts that Orova publishes will be authored by that account.

• 2

  Open Users → Profile. In the left menu choose Users → Profile. If you are an administrator creating one for someone else, go to Users → All Users and click that account.

• 3

  Scroll down to “Application Passwords”. It sits near the bottom of the profile page. If the section is missing, the site runs WordPress older than 5.6, is not served over HTTPS, or a security plugin has switched the feature off.

• 4

  Name it, then click Add New Application Password. Type a name you will recognise later, for example Orova. The name is only there so you know which password to revoke.

• 5

  Copy the 24-character string right away. WordPress shows a 24-character string in six groups, separated by spaces. It is shown only once — close the page and you can never see it again, only create a new one. Pasting it with the spaces is fine.

This is what the WordPress screen looks like — the password line is what you copy:

Users -> Profile -> Application Passwords

  New Application Password Name:  Orova
  [ Add New Application Password ]

  Your new password for Orova is:
      abcd EFGH 1234 ijkl MNOP 5678      <- 24 characters, shown ONCE

/ In Orova

Pasting it into Orova

Open Social → Projects → your project → the Channels tab, and find the Website box. It has three fields and one button.

• 1

  Website address. Paste the root address of the site, starting with https:// — for example https://yoursite.com. Not the admin URL. If you paste something ending in /wp-json, Orova trims it for you.

• 2

  Username. This is your WordPress login name, exactly as it appears in the Username field of the profile — not the display name, and not the email address.

• 3

  Application password. Paste the 24-character string you just copied. Leaving the spaces in is fine.

• 4

  Click Save channel. Orova calls your WordPress site right there and then to check the details. If the check passes, the channel appears in the list with the site address and the username; the channel name and picture come from the WordPress profile.

/ The check

What Orova checks on save

Orova does not store the details blindly. When you click Save channel, it makes one real call to your WordPress REST API with exactly what you typed:

GET https://yoursite.com/wp-json/wp/v2/users/me?context=edit

Headers:
  Authorization: Basic <base64 of "username:application password">
  Accept: application/json

What Orova does with the reply:
  200 + JSON profile   -> channel saved (name and avatar come from
                          the WordPress profile)
  401 / 403            -> wp_auth   (WordPress rejected the login)
  404 / not JSON       -> wp_url    (wrong address, REST API off,
                                     or "Plain" permalinks)
  no reply in 10 s     -> wp_url    (timeout)

The channel is saved only when WordPress answers 200 with a user profile. Orova waits 10 seconds at most. The channel keeps the site address, the username and the Application Password for later publishing; the screen only ever shows the address and the username back to you, never the password.

/ Troubleshooting

Common errors

If the save fails, Orova reports one of two codes: wp_url (it could not reach your site) or wp_auth (WordPress refused the login). Below are the usual causes behind each one.

The lines to add — put them above the # BEGIN WordPress block:

# .htaccess in the WordPress root, above "# BEGIN WordPress"
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

/ Security

Security

• One password per service. Do not reuse an application password across tools. Name each one clearly so you know which is which, and revoking one leaves the others working.
• Revoke whenever you want. Go to Users → Profile → Application Passwords and click Revoke. Orova stops publishing immediately and reports wp_auth; to reconnect, create a new password and save the channel again.
• Consider a dedicated account for Orova. A WordPress user with the Author or Editor role is enough to publish. There is no need to hand over Administrator rights.
• Orova never shows the password again. After saving, the Channels screen only shows the site address and the username. When you disconnect the channel, Orova deletes the stored application password.

/ Wrapping up

Connect once, and you are done

Once the Website channel is connected it lives in that project like any other channel, and you pick it when composing a post in Orova Social. If you rotate the password or switch accounts, fill the three fields again and click Save channel — Orova overwrites the same channel instead of creating a duplicate.