Rotate WordPress Application Passwords Without API Downtime

Rotate WordPress Application Passwords Without API Downtime

Application passwords are convenient for publishing APIs, but rotation can break automation if done as a single cut. A staged overlap strategy keeps publishing live.

Step 1: create new app password while old one is still active

old: wp_app_pwd_v1
new: wp_app_pwd_v2

Step 2: deploy dual-credential validation in publisher service

for cred in [NEW_CRED, OLD_CRED]:
    if publish_with(cred):
        break

Step 3: revoke old credential after successful cutover window

wp user application-password delete 1 "codex-publisher-v1"

Pitfall

Revoking old password before confirming all workers reloaded new secrets.