> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mainwp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Application Passwords

> Create, view, and revoke WordPress Application Passwords from MainWP Dashboard API Access for integrations that use username and password-based API auth.

MainWP Dashboard includes a dedicated **Application Passwords** screen under **API Access** so you can manage credentials without leaving the Dashboard navigation.

<Note>
  Application Passwords are WordPress-level credentials and are separate from MainWP API keys. They can be revoked without changing your login password.
</Note>

## What You'll Learn

* Where Application Passwords are managed in MainWP Dashboard
* How to create and securely store a new password
* How to use the Connect an AI tool panel
* How to review usage and revoke credentials
* When to use Application Passwords vs API keys

***

## Prerequisites

* MainWP Dashboard administrator access
* A WordPress user account that should own the credential
* HTTPS enabled on your Dashboard domain

***

## Create an Application Password

<Steps>
  <Step title="Open Application Passwords">
    Go to **Dashboard > API Access > Application Passwords**.
  </Step>

  <Step title="Create a new credential">
    Click **Create Application Password**, enter a descriptive **Application Password Name** (for example, `Claude Desktop`, `Zapier`, or `Internal Script`), then click **Create**. The credential belongs to your current WordPress user.
  </Step>

  <Step title="Copy the generated password">
    Copy it immediately and store it in your password manager or secret store.

    <Warning>
      The full password is shown only once.
    </Warning>
  </Step>

  <Step title="Test authentication">
    Use the WordPress username with the Application Password in HTTP Basic authentication.
  </Step>
</Steps>

```bash theme={null}
curl -u "USERNAME:APPLICATION_PASSWORD" \
  "https://your-dashboard.com/wp-json/wp-abilities/v1/abilities"
```

***

## Connect an AI Tool

In MainWP Dashboard 6.3, the **Application Password Created** dialog includes a **Connect an AI tool** panel. Select **Claude Code**, **Cursor**, or **VS Code**, then click that tab's **Copy** button.

| Client | What MainWP prepares | Where to use it |
| - | - | - |
| **Claude Code** | A terminal command with the Dashboard URL, current username, and newly generated password; it registers MainWP MCP at user scope | Run the command on the computer running Claude Code |
| **Cursor** | JSON with the Dashboard URL, current username, and newly generated password | Add it to the global `~/.cursor/mcp.json`, then restart Cursor |
| **VS Code** | JSON with the Dashboard URL and current username, plus a masked password prompt | Add it to `.vscode/mcp.json`; enter the Application Password when VS Code first starts the server |

The panel requires Node.js 20.19 or later on the computer running your AI tool. It configures the MainWP MCP server; it does not install or launch the AI client.

Save the password before clicking **Done**. Claude Code's command contains the password and can remain in shell history; Cursor's configuration contains it too. Keep these values out of shared repositories. The VS Code snippet uses a password input instead of placing the secret in the file.

When the Application Passwords table is empty and the welcome notice is visible, the same panel appears there with the URL and username prefilled. Claude Code and Cursor use `YOUR-APPLICATION-PASSWORD` until you create a credential. The success dialog supplies the actual new password; the notice cannot retrieve an existing one.

For other clients, use [Connect Your AI Client](/mcp-server/clients).

### Create Credentials from the Guided AI Pages

You can also create a password without leaving **MainWP > AI > MainWP MCP** or **MainWP > AI > MainWP Control**. In **Credentials**, click **Create Application Password**. The name is prefilled for that tool and can be changed before creation.

On the MCP page, the new password replaces the placeholder in the **Connect** configuration while that page remains open. Copy it before leaving or reloading the page. The Control page provides separate installation and login commands; it does not embed your password in those commands.

***

## View and Revoke Passwords

In **Dashboard > API Access > Application Passwords**, you can review existing entries, including metadata such as creation time and last use details.

* Revoke individual credentials that are no longer needed.
* Revoke all credentials for incident response or full rotation.
* Recreate passwords per integration to keep access scoped and auditable.

***

## API Keys vs Application Passwords

| Credential Type | Best For | Auth Style | Managed In |
| - | - | - | - |
| API Key | MainWP REST API v2 integrations | `Authorization: Bearer ...` | **Dashboard > API Access > API Keys** |
| Application Password | Tools that use username/password auth (for example MCP or other WordPress REST clients) | HTTP Basic (`-u user:password`) | **Dashboard > API Access > Application Passwords** |

***

## Security Recommendations

* Create a separate credential per tool or integration.
* Revoke unused credentials regularly.
* Avoid sharing one credential across multiple systems.
* Use a dedicated API user for production automations.

***

## Related Resources

* [REST API Overview](/api-reference/rest-api/overview) - API key setup, endpoint categories, and request patterns
* [MainWP MCP Server](/mcp-server/overview) - Application Password-based AI tooling setup
* [AI Menu](/dashboard/overview/mainwp-ai) - Guided MCP and Control setup in MainWP Dashboard


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.