title: WordPress API Permission Callback – Check if user is logged in
body: <p>I have a question about permission callbacks when working with the WP Rest API. I have registered a couple of endpoints using register_rest_route and simply want to secure them so that you can’t access the content if you’re not logged in.</p>
  
  <pre><code>add_action('rest_api_init', 'register_custom_endpoints');
  
  function register_custom_endpoints(){
      register_rest_route($base, $endpoint, [
          'methods' =&gt; 'POST',
          'callback' =&gt; function($request){
              // Return JSON data
          },
          'permission_callback' =&gt; function($request){
              // This always returns false
              return is_user_logged_in();
          },
      ]);
  }
  </code></pre>
  
  <p>I think my logic here is correct but <code>is_user_logged_in()</code> always returns false, meaning I’ll never get the data even if I’m actually logged in. All I get is a 404 response:</p>
  
  <pre><code>{code: "rest_user_invalid_id", message: "Invalid user ID.", data: {status: 404}}
  </code></pre>
  
  <p>I’ve been scouring the web for answers and what I’ve found is that I need to send a nonce with the request. I’ve tried sending it both as body data and as a header. If I send it in the body, I can’t verify it as it always returns false. And if I send it as a header, I get the same 404 response as stated above.</p>
  
  <p>What am I missing here, and what am I doing wrong?</p>