JWT Authentication PRO

JWT Authentication PRO and the REST API workflow

JWT Authentication PRO extends the WordPress REST API authentication flow for external applications, mobile interfaces, JavaScript clients, and other services. The underlying extension includes the jwt-auth/v1 namespace, including POST endpoints to make and validate tokens. The token endpoint accepts a username and password and returns a JSON Web Token (JWT) after successful authentication. Clients can send the token in the Authorization: Bearer header with later API requests.

The base token flow handles creation and validation. PRO adds settings for signing, session management, configuration, and monitoring.

Signing and token lifecycle

• Signing algorithms: The base extension uses HS256. PRO adds alternatives including RS256 and ES256.
• Refresh: An additional endpoint can refresh an expired token without requiring another login.
• Revocation: Revoke a token when its access should end.
• Custom claims: Add claims to the JWT payload through the PRO settings.

These functions address various parts of a session: validation checks a supplied token, refresh continues an authentication workflow, and revocation ends access for a token.

Configuration and activity controls

PRO offers a WordPress admin interface for managing settings. It also adds more granular CORS controls for allowed origins and headers, configurable rate limits, and audit logs for token generation, validation, and errors. Enhanced error tracking and monitoring provide more visibility into authentication activity. Priority support is included with the PRO offering.

JWTs require a unique signing secret that must remain confidential. The underlying plugin can configure the secret through the JWT_AUTH_SECRET_KEY constant in wp-config.php; PRO settings can be managed through the admin interface. CORS can be enabled with the documented JWT_AUTH_CORS_ENABLE constant, while PRO provides additional controls in its settings.

Requirements and setup

The plugin is built on WordPress REST API V2 and requires the WP REST API plugin to be installed and activated. The stated minimum PHP version is 7.4.0. Some hosting environments require the HTTP Authorization Header to be enabled or passed through.

1. Install and activate the WP REST API plugin.
2. Install and activate JWT Authentication PRO.
3. Open the available settings area and configure the authentication options.
4. Confirm that the hosting environment makes the HTTP Authorization Header available.
5. Test token creation, validation, refresh, and revocation with the REST API endpoints used by the application.

Developers can use the REST API authentication workflow and available hooks when connecting WordPress to custom applications.