title: Using nonce in custom Wordpress API end-point
body: <p>I'm trying to write an plugin that allows a Wordpress authenticated user to access Firebase. I'd like a Javascript app that is delivered from Firebase hosting to make an API request to Wordpress and get back a signed JWT.</p>
  <p>Since I want to use the authenticated user, I figure I'll need to send a nonce with the API request. In order to test that I've got the following code Plugin code:</p>
  <pre><code>function my_awesome_func($data) {
    $uid = $data['id'];
    // var_dump($data);  
    var_dump(wp_create_nonce( 'wp_rest' ));
    var_dump(get_current_user_id());
    return $uid;
  }
  
  
  add_action( 'rest_api_init', function () {
    register_rest_route( 'telomere/firebase_jwt/v1', '/user/(?P&lt;id&gt;\d+)', array(
      'methods' =&gt; 'GET',
      'callback' =&gt; 'my_awesome_func',
    ) );
  } );
  </code></pre>
  <p>The idea being - the first time I hit the end-point it returns the nonce. I'll then append it to the URL and try again, hopefully getting the current user details the second time around.
  <code>http://localhost/wp-json/telomere/firebase_jwt/v1/user/1234?_wpnonce=&lt;nonce&gt;</code></p>
  <p>All I get back is
  <code>{&quot;code&quot;:&quot;rest_cookie_invalid_nonce&quot;,&quot;message&quot;:&quot;Cookie nonce is invalid&quot;,&quot;data&quot;:{&quot;status&quot;:403}}</code></p>
  <p>How do I fix this code so that it provides and accepts a nonce?</p>
  <p>Thanks,</p>