Your browser sends the WordPress login cookie with every request to your site. Yet a plain fetch(‘/wp-json/wp/v2/users/me’) from a logged-in page still comes back as a logged-out visitor. The missing piece is the nonce, and it’s the whole point of how cookie auth works in the REST API. I kept asking “but what actually happens?”… Continue reading Cookies, Nonces and the WordPress REST API