Manage WordPress REST API access with JWTs

JWT Authentication PRO extends the WordPress REST API authentication flow for applications, mobile interfaces, JavaScript clients, and other services. A client sends user credentials to the token endpoint and receives a JSON Web Token (JWT) after successful authentication. It can send that token in the Authorization header with later API requests.

The base add-on includes token creation and validation in the jwt-auth/v1 namespace. Its token endpoint accepts credentials, and its validation endpoint checks a token supplied in the Authorization header. PRO adds endpoints for refreshing and revoking tokens, giving applications a way to continue a session or end access.

Signing, session, and access controls

• Signing algorithms: Choose additional algorithms, including RS256 and ES256. The base add-on uses HS256.
• Custom claims: Add claims to the JWT payload through the admin interface.
• Token refresh and revocation: Refresh tokens without requiring another login, or revoke a token when access should end.
• Configuration: Manage options in the WordPress admin area, including more precise controls for allowed CORS origins and headers.
• Rate limiting and audit logs: Configure limits for endpoints and review records of token generation, validation, and errors.
• Support: The PRO edition includes priority support.

Requirements and setup

The plugin is built on WordPress REST API V2 and requires the WP REST API plugin to be installed and active. The stated minimum PHP version is 7.4.0. Some hosting environments require the HTTP Authorization Header to be enabled. JWT signing also requires a unique secret key that stays confidential.

1. Install and activate the WP REST API plugin.
2. Install and activate JWT Authentication PRO.
3. Open the settings area in WordPress admin and configure the authentication settings.
4. Confirm that the hosting environment passes the HTTP Authorization Header.
5. Test token creation, validation, refresh, and revocation through the endpoints used by the application.

When a client sends a valid token, the REST API request continues through its normal flow. Invalid credentials, an invalid signature, or an expired token can return an authentication error. Check the hosting header configuration and signing settings when requests fail.