Development workflow Intro
The REST API you already have
You are already using it even if you never go headless — this is how the block editor saves your posts. Knowing the response shape halves your client…
Technote
The REST API and going headless
Using WordPress as a data source, and where that stops working — endpoint design, authentication, caching and security, in build order.
4 articles
Development workflow Intro
Exposing a post type and its meta with show_in_rest
A post type opens with one line. Meta does not: it needs a registered type, an auth_callback governs writing, and reading opens regardless.
Development workflow Practical
Your own endpoint: namespace, permission callback, schema
permission_callback is not optional. Omit it and the route is public, with a core warning to match. An args schema then keeps validation out of your handler entirely.
Security Practical
Choosing authentication: cookies, application passwords, tokens
These three differ in threat model, not convenience. Whether the caller is a browser, your own server, or a third party decides the answer for you.