Wow Momo Authentication

generated: '2026-09-04'
method: probed
source: >-
  https://www.wowmomo.com/wp-json/ route-discovery document (HTTP 200, saved verbatim to
  openapi/wow-momo-content-api-discovery-original.json) plus live anonymous probes of
  www.wowmomo.com and api.wowmomo.com on 2026-09-04
docs: null
note: >-
  WOW! Momo publishes no authentication documentation of any kind. This profile is read from the live
  route-discovery document's own `authentication` block, from response headers observed on the wire,
  and from the bodies the hosts return anonymously. Nothing here is inferred from a vendor default.
summary:
  types:
  - http
  - apiKey
  - opaque-application-credential
  api_key_in:
  - header
  oauth2_flows: []
schemes:
- name: applicationPassword
  type: http
  scheme: basic
  hosts:
  - https://www.wowmomo.com
  authorization_endpoint: https://www.wowmomo.com/wp-admin/authorize-application.php
  evidence: >-
    The /wp-json/ index declares authentication.application-passwords.endpoints.authorization verbatim
    as https://www.wowmomo.com/wp-admin/authorize-application.php.
  sources:
  - openapi/wow-momo-content-api-discovery-original.json
  note: >-
    WordPress application passwords. Required for every write on the content surface. Issued only from
    inside wp-admin, so no third party can obtain one.
- name: wpNonce
  type: apiKey
  in: header
  name_header: X-WP-Nonce
  hosts:
  - https://www.wowmomo.com
  evidence: >-
    Observed 2026-09-04 in the live response header access-control-allow-headers: Authorization,
    X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type.
  note: Cookie-session nonce; usable only from a browser already logged in to wp-admin.
- name: wowMomoAppCredential
  type: opaque-application-credential
  hosts:
  - https://api.wowmomo.com
  evidence: >-
    Every anonymous request to api.wowmomo.com on 2026-09-04 — including the control path
    /.well-known/wow-momo-negative-control-9f2c41d7, which cannot exist — returned HTTP 200 with the
    identical body {"data":null,"message":"NO_AUTH","messageType":"FAILED"} from an Express service
    behind an AWS Application Load Balancer. Only GET /health answers differently, returning "OK".
  note: >-
    The credential scheme is not documented anywhere public. The gate returns 200 rather than 401, so
    even the failure mode is undiscoverable by status code alone; the message name (NO_AUTH) is the only
    signal. Issuance path, credential format, header name and scope model are all unobservable without a
    credential. Recorded as gated, not guessed.
anonymous_read:
  available: true
  hosts:
  - https://www.wowmomo.com/wp-json
  note: >-
    The wp/v2 content collections read with no credential at all. pages, media, categories, tags, users,
    types, taxonomies, statuses, search, comments and blocks all returned HTTP 200 anonymously on
    2026-09-04, each with `Allow: GET`, as did /oembed/1.0/embed and /yoast/v1/get_head.
  gated_anonymously:
  - path: /wp/v2/settings
    status: 401
    code: rest_forbidden
  - path: /wp/v2/menus
    status: 401
    code: rest_cannot_view
  - path: /wp/v2/plugins
    status: 401
    code: rest_cannot_view_plugins
  - path: /wp/v2/themes
    status: 401
    code: rest_cannot_view_themes
  - path: /wp/v2/block-types
    status: 401
    code: rest_block_type_cannot_view
  - path: /wp-abilities/v1/abilities
    status: 401
    code: rest_forbidden
  - path: /contact-form-7/v1/contact-forms
    status: 403
    code: wpcf7_forbidden