From ddfe438b1ce7dc9c63af9f9ffa1d34c1540c3692 Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Wed, 21 Oct 2026 10:29:36 -0400 Subject: [PATCH] docs: update FaustWP before connecting with an Application Password --- docs/how-to/authentication/index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/how-to/authentication/index.md b/docs/how-to/authentication/index.md index df9571c3f..004b92798 100644 --- a/docs/how-to/authentication/index.md +++ b/docs/how-to/authentication/index.md @@ -112,6 +112,8 @@ You are now ready to access the auth page you created. In your terminal start up Your Next.js server exchanges authorization codes for tokens by calling the FaustWP plugin. It can authenticate those calls with a WordPress [Application Password](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/) instead of `FAUST_SECRET_KEY`. Each Application Password belongs to one user, can be revoked on its own, and only allows what that user's role allows. +This needs FaustWP 1.9.0 or later, so update the plugin before setting the variables below. Older versions of the plugin reject the Application Password, and logins and previews stop working. + 1. Create a WordPress user for your frontend and give it a role with the `faustwp_exchange_tokens` capability. Administrators have it by default, but a dedicated low-privilege user is safer: ```php title="my-plugin.php"