Drive the WordPress REST API (/wp-json/wp/v2) with curl + jq.

The user's self-hosted WordPress credentials are injected as env vars:

$WORDPRESS_SITE_URL — site root, e.g. https://blog.example.com
$WORDPRESS_USERNAME — the WordPress login username
$WORDPRESS_APP_PASSWORD — an Application Password (WP 5.6+ core), NOT the login password. Treat it like a secret — never log or echo it.

Auth is HTTP Basic (username:app_password) over HTTPS. Set up a reusable base once, then every call reuses it:

# Normalize the site URL (strip a trailing slash) and build the API base.
SITE="${WORDPRESS_SITE_URL%/}"
API="$SITE/wp-json/wp/v2"
# -u sends HTTP Basic auth; --fail-with-body surfaces the JSON error body on 4xx/5xx.
WP=(curl -sS --fail-with-body -u "$WORDPRESS_USERNAME:$WORDPRESS_APP_PASSWORD")

wordpress