Use a WordPress Application Password to authenticate a Formidable REST API, Abilities API, or remote MCP request. An Application Password belongs to a single WordPress user. The request has the same permissions as that user.

Requirements

• A WordPress site that supports Application Passwords.
• For REST API v2 or v3 requests: Formidable Forms Pro and the Formidable API add-on installed and activated. REST API v3 needs version 2.0 or newer of the add-on. The API add-on is available on the Business and Elite licenses.
• For Abilities API or Formidable MCP requests: WordPress 6.9 or newer and Formidable Forms 7.0 or newer, with Enable the Formidable MCP server turned on. Formidable Forms Lite is enough.
• For Formidable MCP requests: PHP 7.4 or newer.
• HTTPS when credentials travel over a network.
• A dedicated WordPress user with only the permissions required by the integration.

Configure the WordPress user

1. Go to Users → Add User and create a dedicated user for the integration, or select an existing one.
2. Assign the user a low-privilege WordPress role, such as Subscriber. You grant the Formidable access in the next steps, so the role doesn't need any other permissions.
3. Go to Formidable → Global Settings → Permissions.
4. Under each required Formidable permission, select the integration user's role, such as Subscriber.
5. Click Update to save your changes.

For example, a read-only reporting client can use View Forms List and View Entries from Admin Area. Don't give it entry, form, View, or Application change permissions unless it must change that data.

An Abilities API or MCP user also needs the standard WordPress Read permission to discover the public ability catalog. This permission doesn't appear on the Formidable Permissions screen. WordPress's built-in roles, including Subscriber, already have it. If you use a custom role from a role-management plugin, confirm this permission there.

Create an Application Password

1. Sign in as the dedicated WordPress user.
2. Open the profile screen. An administrator or editor goes to Users → Profile. A Subscriber clicks Profile in the main menu.
3. Go to the Application Passwords section.
4. Enter a clear name in New Application Password Name. Include the client and purpose, such as Codex Formidable staging.
5. Click Add Application Password.
   

   

6. Copy the password immediately. WordPress shows it only once.
   

   

7. Store the password in the protected credential settings for the client. Don't paste it into an AI chat, prompt, support message, or public file.

Use a connection file for MCP

For an MCP connection, Formidable can create the Application Password for you. Each download creates a new Application Password for your own account. The connection file holds that password, your site URL, and your username. An MCP client that uses the file acts with your account's permissions.

To download a connection file, your role needs the Access this Settings Page permission. A public site also needs HTTPS.

1. Go to Formidable → Global Settings → MCP.
2. If it's off, toggle on Enable the Formidable MCP server. Click Update to save your changes.
3. Under Download your connection file, click Download frm-mcp.env. After your first file, this button reads Download a new file.
   

   

A password from a connection file works differently from one you create yourself:

• It only works with the Formidable MCP server. It's refused on other REST API routes, including /frm/v3 and /wp-abilities/v1, and outside the REST API.
• It's listed with your other Application Passwords on your profile screen.
• To revoke it, go back to the MCP tab. Under Download your connection file, expand the list of files, such as Manage 2 connection files. Each file shows the date it was created. Click Revoke next to the file.
  

  

Learn more about how to connect a remote site with a connection file.

Choose the endpoint

Use the endpoint for the interface that your client supports.

Test a REST API request in Postman

1. Download and open Postman. Create a new HTTP request.
2. Select GET.
3. Enter your site URL followed by /wp-json/frm/v3/entries.
4. Open the Authorization tab.
5. Select Basic Auth.
6. Enter the dedicated WordPress username as the username.
7. Enter its Application Password as the password.
8. Click Send.

The same credentials can authenticate supported POST, PATCH, and DELETE requests. The WordPress user must have the permission required for each operation.

Revoke an Application Password

Open your profile, as in the steps above, and go to Application Passwords. Find the client name and click Revoke.

Revoke the passwords created by MCP connection files before you deactivate Formidable Forms. Without Formidable, they keep working as regular Application Passwords.

Limitations

• An Application Password authenticates a request. It doesn't bypass the WordPress user's Formidable permissions.
• A password created by an MCP connection file only works with the Formidable MCP server.
• A local WP-CLI MCP connection doesn't use an Application Password.
• The MCP Connections table records authenticated HTTP MCP activity. It doesn't record local WP-CLI connections.

Troubleshooting

• 403 "Your API key is incorrect": On /frm/v2 and /frm/v3 routes, a wrong, mistyped, or revoked Application Password returns this message. Confirm the WordPress username and Application Password, or create a new password. Confirm that the client uses Basic Auth and HTTPS.
• 401 Unauthorized: On /wp-abilities/v1 and /wp-json/mcp/formidable-mcp, a wrong username or Application Password returns this status. Confirm the WordPress username and Application Password. Confirm that the client uses Basic Auth and HTTPS.
• 403 "Sorry, you are not allowed…": The credentials are valid, but the WordPress user doesn't have the required Formidable permission. Add only the missing permission. A request with no credentials on a /frm/v2 or /frm/v3 route returns a similar message, so confirm that the client sends Basic Auth. If the message is "This application password can only access Formidable MCP abilities.", the password came from an MCP connection file. Create a separate Application Password for other requests.
• 404 Not Found: Confirm the endpoint and that REST API is on under Formidable → Global Settings → API, which controls both /frm/v2 and /frm/v3. Use /frm/v3 for a new Formidable REST integration.
• 403 "The Formidable MCP server is turned off": Turn on Enable the Formidable MCP server under Formidable → Global Settings → MCP. With it off, the MCP endpoint returns this message, and the Abilities API lists no Formidable abilities.
• MCP client cannot discover Formidable tools: Confirm that Enable the Formidable MCP server is on under Formidable → Global Settings → MCP and that the client uses /wp-json/mcp/formidable-mcp. If your Formidable license has expired, the Pro abilities aren't available.

Related articles

• Form Webhooks API
• Formidable REST API endpoint reference
• Use the Formidable Abilities API
• Connect Formidable Forms to Your AI Agent with MCP
• WordPress Application Passwords integration guide