Application passwords, and the script that stops using a real one

Authenticating a script against the REST API meant cookies and a nonce, which needs a browser, or a real password in a configuration file.

# generated per application, in the user's profile screen
$ curl -u 'turker:abcd EFGH ijkl MNOP qrst UVWX' 
    https://shop.example/wp-json/wp/v2/posts

# what it is: basic auth over TLS, with a revocable credential.
# what it is NOT: scoped. an application password has the
# user's full capabilities.

Saying plainly that it is basic auth is more useful than implying otherwise — the security property is revocability and the absence of the real password, not a permission model. There is no scoping, so a script that only reads posts holds a credential that can delete users if the account can. Creating a dedicated user with a minimal role and giving the script that user’s application password is the mitigation, and it is the arrangement worth defaulting to.