Yep, using the wordpress username of the admin, and I've copied the password from my password manager to be sure it's exactly correct. There's no proxy, and the firewall is open for HTTP and HTTPS on both servers. I tried temporarily disabling all plugins except yours to be sure, and the same error occurs.
I can cURL or use Postman to access any other route fine, but I get this with /wp/v2/settings:
{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}
Using Postman, I've tried both basic auth and using the Flarum API key as the bearer token (with and without the token pasted in the WP settings, since I'm not sure if that's what the token is being matched to), and I still can't seem to access /wp/v2/settings. 🤔
EDIT: As an aside, I can't believe how much data leakage WP let's through the REST API! Once I've sorted this auth issue out I'll definitely be restricting access to https://example.com/index.php?rest_route=/wp/v2/users, that should not be available by default without any authentication. 😐
EDIT 2: I'm at a loss. I can't seem to access the settings endpoint using admin accounts on any wordpress site I have control of. I've checked to confirm that the admin roles have the manage_options permission, and still, I can't get them to authenticate on that endpoint. Always returns a 401. Is anyone else on Wordpress 5.4 having this problem?
