JWT Authentication for WP REST APIs Premium Plan

Choose how applications access your WordPress REST API

JWT Authentication for WP REST APIs Premium Plan provides authentication for default WordPress endpoints, custom-developed REST endpoints, and endpoints from third-party extensions. It can support mobile applications, external services, custom integrations, and other clients that need authenticated API access.

Choose JWT Authentication, API Key Authentication, Basic Authentication, OAuth 2.0, or external token authentication. Supported external provider approaches include OIDC, JWT, and Firebase provider tokens. Authentication can also cover endpoints from WooCommerce, LearnDash, BuddyPress, Gravity Forms, CoCart, and other third-party add-ons.

Match the method to the client

• JWT Authentication: A client exchanges visitor credentials at an authentication endpoint for a JSON Web Token, then sends the token to access protected REST APIs.
• API Key Authentication: Use a universal API key or a user-specific API key.
• Basic Authentication: Authenticate with a username and password or an email and password.
• OAuth 2.0: Use Password Grant or Client Credentials Grant.
• External provider authentication: Accept supported third-party access tokens, including JWT tokens.

Manage tokens and endpoint access

The Premium Plan includes login, refresh, and revoke token endpoints. A client can request a new access token with a refresh token when the current token expires, reducing the need to repeat logins. Revoke controls can invalidate tokens for admin-triggered logout or session control, including when a device is lost or compromised.

Authentication can be applied to all REST API endpoints, including core WordPress, custom, and third-party extension endpoints. Selective API protection lets you pick which endpoints require authentication. You can also restrict access for non-logged-in users or disable the WordPress REST APIs.

Additional options include time-based token expiry, role-based REST API authentication, and a custom header in place of the Authorization header. The plugin can create WordPress users based on access tokens from third-party providers.

Set up the authentication flow

1. Install the plugin in WordPress.
2. Select the authentication method your application needs and configure its API protection settings.
3. Choose the endpoints or endpoint groups to protect, then set token expiry and role rules where needed.
4. Give the client the appropriate token, API key, credentials, or OAuth flow.
5. Test the selected endpoint with that authentication method before connecting the production application.

The plugin does not shop user data.