WP_Application_Passwords::create_new_application_password( int $user_id, array $args = array() ): array|WP_Error

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$user_idint

User ID.

$argsarrayoptional

Arguments used to create the application password.Default: array()

• $namestring

  The name of the application password.

• $app_idstring

  A UUID provided by the application to uniquely identify it.

Return value

array|WP_Error

Application password details, or a WP_Error instance if an error occurs.

• $0string

  The generated application password in plain text.

• $1array

  The details about the created password.

  • $uuidstring

    The unique identifier for the application password.

  • $app_idstring

    A UUID provided by the application to uniquely identify it.

  • $namestring

    The name of the application password.

  • $passwordstring

    A one-way hash of the password.

  • $createdint

    Unix timestamp of when the password was created.

  • $last_usednull

    Null.

  • $last_ipnull

    Null.

Performance profile

How much work a call to WP_Application_Passwords::create_new_application_password() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Moderate

Reads stored settings via get_network_option(), cached per request but not free on a cold cache.

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

15–77

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 95.

Plugin surface

1 hook

Third-party callbacks on 'wp_create_application_password' run inside this call, and their cost is not bounded by anything here.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• optionnetwork optionget_network_option()called directly
• hookthird-party callbacksdo_action()called directly
• cacheobject cachewp_cache_get()one call below WP_Application_Passwords::create_new_application_password()
• serializeserialisationmaybe_unserialize()one call below WP_Application_Passwords::create_new_application_password()

Further down the call graph this can also reach transient and query. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 8 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost WP_Application_Passwords::create_new_application_password() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 1

One hook fires while WP_Application_Passwords::create_new_application_password() runs, in this order:

1. 1
   do_action( wp_create_application_password )actionline 150 (+61 into the body)

   Fires when an application password is created.

Uses · 12

• sanitize_text_field()Sanitizes a string from user input or from the database.
• __()Retrieves the translation of $text.
• wp_generate_password()Generates a random password drawn from the defined set of characters.
• wp_generate_uuid4()Generates a random UUID (version 4).
• get_main_network_id()Gets the main network ID.
• get_network_option()Retrieves a network's option value based on the option name.
• update_network_option()Updates the value of a network option that was already added.
• do_action()Calls the callback functions that have been added to an action hook.
• WP_Error::__construct()Initializes the error.
• WP_Application_Passwords::hash_password()Hashes a plaintext application password.
• static::get_user_application_passwords()
• static::set_user_application_passwords()

Used by · 1

• WP_REST_Application_Passwords_Controller::create_item()Creates an application password.

Source code

View on Trac ↗View on GitHub ↗

89	public static function create_new_application_password( $user_id, $args = array() ) {90		if ( ! empty( $args['name'] ) ) {91			$args['name'] = sanitize_text_field( $args['name'] );92		}93 94		if ( empty( $args['name'] ) ) {95			return new WP_Error( 'application_password_empty_name', __( 'An application name is required to create an application password.' ), array( 'status' => 400 ) );96		}97 98		$new_password    = wp_generate_password( static::PW_LENGTH, false );99		$hashed_password = self::hash_password( $new_password );100 101		$new_item = array(102			'uuid'      => wp_generate_uuid4(),103			'app_id'    => empty( $args['app_id'] ) ? '' : $args['app_id'],104			'name'      => $args['name'],105			'password'  => $hashed_password,106			'created'   => time(),107			'last_used' => null,108			'last_ip'   => null,109		);110 111		$passwords   = static::get_user_application_passwords( $user_id );112		$passwords[] = $new_item;113		$saved       = static::set_user_application_passwords( $user_id, $passwords );114 115		if ( ! $saved ) {116			return new WP_Error( 'db_error', __( 'Could not save application password.' ) );117		}118 119		$network_id = get_main_network_id();120		if ( ! get_network_option( $network_id, self::OPTION_KEY_IN_USE ) ) {121			update_network_option( $network_id, self::OPTION_KEY_IN_USE, true );122		}123 124		/**125		 * Fires when an application password is created.126		 *127		 * @since 5.6.0128		 * @since 6.8.0 The hashed password value now uses wp_fast_hash() instead of phpass.129		 *130		 * @param int    $user_id      The user ID.131		 * @param array  $new_item     {132		 *     The details about the created password.133		 *134		 *     @type string $uuid      The unique identifier for the application password.135		 *     @type string $app_id    A UUID provided by the application to uniquely identify it.136		 *     @type string $name      The name of the application password.137		 *     @type string $password  A one-way hash of the password.138		 *     @type int    $created   Unix timestamp of when the password was created.139		 *     @type null   $last_used Null.140		 *     @type null   $last_ip   Null.141		 * }142		 * @param string $new_password The generated application password in plain text.143		 * @param array  $args         {144		 *     Arguments used to create the application password.145		 *146		 *     @type string $name   The name of the application password.147		 *     @type string $app_id A UUID provided by the application to uniquely identify it.148		 * }149		 */150		do_action( 'wp_create_application_password', $user_id, $new_item, $new_password, $args );151 152		return array( $new_password, $new_item );153	}

Changelog

Introduced in 5.6.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.0.4 tag, from src/wp-includes/class-wp-application-passwords.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.