Use the authentication method the receiving API documents—not whichever sounds most secure. For WordPress REST access, a dedicated Application Password is typically sent with Basic Auth over HTTPS. For an OAuth-protected API, use its access token as a Bearer token when its instructions say to. For a Contact Form 7 integration such as Brevo, use the service-specific API key and setup procedure. These credentials and methods are not interchangeable.
How the three terms differ
Basic and Bearer are HTTP authentication schemes: they describe how a credential is presented in a request. An API key is a credential issued by a service. Its documentation determines whether it belongs in a custom header, an Authorization header, a query parameter, or another location.
As an Amazon Associate I earn from qualifying purchases.
| Option | What it is | Typical presentation | What determines whether to use it |
|---|---|---|---|
| Basic Auth | An HTTP scheme that carries a user ID and password joined with a colon, then encoded with Base64. | Authorization: Basic … |
The endpoint accepts Basic Auth; for WordPress, use an Application Password over HTTPS rather than an account’s main password. |
| Bearer | An HTTP scheme for presenting an access token, commonly an OAuth 2.0 access token. | Authorization: Bearer <access-token> |
The API’s documented authorization flow issues a token and specifies Bearer presentation. |
| API key | A service-issued credential; “API key” alone does not define an HTTP scheme. | Whatever the provider documents, such as a particular header or parameter. | The provider’s API contract and key permissions. |
Base64 is encoding, not encryption. RFC 7617 warns that Basic “is not considered to be a secure method of user authentication unless used in conjunction with some external secure system such as TLS” (RFC 7617). Use HTTPS for Basic credentials and Bearer tokens.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose by the system you are connecting to
Authenticating a script to a WordPress site
For programmatic access to a self-hosted WordPress site as a user, WordPress documents Application Passwords: separate credentials intended for applications, individually revocable, and typically sent using Basic Auth over HTTPS. This avoids sharing the user’s main password with an integration. Follow WordPress’s Application Password instructions.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Calling an OAuth-protected API
If the API’s authorization flow issues an OAuth access token and directs clients to use Bearer, send it as Authorization: Bearer <access-token>. Follow that API’s requirements for obtaining the token, scopes, expiry, and refresh. RFC 6750 defines Bearer token use for OAuth 2.0 (RFC 6750).
Connecting Contact Form 7 to an external service
Contact Form 7’s integration with Brevo uses a Brevo v3 API key configured through the plugin’s integration setup. Use the service-specific instructions in the Contact Form 7 Brevo integration guide; do not substitute a WordPress Application Password or assume the key should be sent as a Bearer token.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Reading a public WordPress endpoint
WordPress REST API data that is public is generally accessible anonymously, subject to the endpoint and site configuration. If the endpoint permits the needed request without credentials, do not add secrets unnecessarily. The WordPress REST API reference describes the API and its resources.
Recommended Free Tools
When a provider only says “API key”
Pause and consult the provider’s current authentication documentation. The phrase does not tell you where the key goes or whether a particular scheme is required. Do not guess by putting a key in a URL or an Authorization header.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What Contact Form 7’s REST API use means
Contact Form 7 version 4.8 and later uses the WordPress REST API for Ajax form submissions, according to its REST API FAQ. If the REST API is unavailable, Ajax submission is unavailable, although non-Ajax submission can still be possible. This is about how the form submits on the site; it is not a reason to add a Bearer token, API key, or Basic Auth credentials to public-facing form code.
When form data is sent onward to an external service, that integration has its own credential requirements. Contact Form 7’s external API integration documentation provides the broader context.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep credentials and permissions under control
- Use HTTPS. Basic Auth encodes rather than encrypts the credentials, and a Bearer token is also a secret that must be protected in transit.
- Keep secrets server-side. Do not embed them in public JavaScript, commit them to a public repository, or expose them in screenshots, URLs, or logs.
- Limit and revoke credentials. Prefer a dedicated credential with only the access it needs where the provider supports it. Revoke it when the integration no longer needs access. WordPress Application Passwords can be revoked individually.
- Separate authentication from authorization. Authentication identifies the credential presented; authorization determines whether that identity may perform the requested operation. A successful login does not guarantee permission for every endpoint or action.
- Check the full request path. If WordPress rejects an otherwise correctly configured Application Password, a proxy or hosting layer may be stripping the
Authorizationheader. WordPress lists this as a possible issue in its Application Password guidance.
Contact Form 7 version note
Contact Form 7’s 6.1 announcement, dated June 26, 2025, says the Constant Contact integration was removed in that release and recommends Brevo as an alternative (CF7 6.1 announcement). An older Constant Contact setup page may still be present in the documentation, so it should not be treated as proof of support in 6.1 or later. Confirm current support in the plugin’s documentation for the version in use.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
