Authentication

Most AAM management routes require an authenticated WordPress user with aam_manager and a capability for the feature, such as aam_manage_url_access. WordPress checks the caller. The access_level parameter selects whose AAM rules the route reads or changes.

Application password

Create an application password for the service account in its WordPress profile. Send it with HTTP Basic authentication over HTTPS:

GET /wp-json/aam/v2/urls?access_level=visitor
Authorization: Basic <base64 username:application-password>

This reads visitor URL rules using the service account’s permissions. Generate the Base64 value from username:application-password and treat it as a credential. Each endpoint page lists its AAM capabilities.

AAM JWT

If AAM’s JWT service is enabled, a valid token can authenticate a request through a bearer header:

GET /wp-json/aam/v2/urls?access_level=visitor
Authorization: Bearer <aam-jwt>

The token identifies its WordPress user. That user still needs the route’s management capabilities. AAM also supports configured query, POST, and cookie token carriers; see ConfigPress for service.jwt.bearer.

Login endpoint

POST /wp-json/aam/v2/authenticate is an exception: it accepts username and password from a logged-out client and returns user data. It does not issue a JWT. See the login endpoint and JWT routes for their distinct responses.