JWT Authentication for WP REST APIs Premium Plan manages authenticated access for mobile applications, external services, and custom integrations across default WordPress REST API endpoints, custom-developed endpoints, and endpoints from third-party add-ons. It also works with endpoints from WooCommerce, LearnDash, BuddyPress, Gravity Forms, CoCart, and other extensions.

Choose JWT, API key, Basic, OAuth 2.0, or external token-based authentication. Supported external provider approaches include OIDC and JWT, along with Firebase provider tokens.

How token authentication works

With JWT Authentication, a client exchanges user credentials at an authentication endpoint for a JSON Web Token, then uses that token to access protected WordPress REST APIs. The Premium Plan includes login, refresh, and revoke token endpoints.

A refresh token lets a client request a new access token when the current one expires, which can reduce repeated logins. Revoke controls invalidate tokens and can support admin-triggered logout or session control, including when a device is lost or compromised.

Choose a credential method

• API Key Authentication: Use a universal API key or a user-specific API key.
• Basic Authentication: Authenticate with a username and password or an email and password.
• OAuth 2.0: Use Password Grant or Client Credentials Grant.
• External provider authentication: Accept supported third-party access tokens, including JWT tokens.

Control endpoint access

The plan can authenticate all REST API endpoints, including core WordPress, custom, and third-party plugin endpoints. Select which endpoints require authentication, restrict access for non-logged-in users, or disable the WordPress REST APIs.

Additional controls include time-based token expiry, role-based WordPress REST API authentication, and the option to use a custom header instead of only the Authorization header. The add-on can also create WordPress users based on access tokens supplied by third-party providers.

Set up an application

Install the plugin, choose the authentication method the application needs, and configure API protection. Choose the endpoints or endpoint groups to protect, set token expiry and role rules where needed, then provide the client with the appropriate token, API key, credentials, or OAuth flow. Test the selected endpoint with that authentication method before connecting the production application.

The plugin does not store user data.