When an application logs in to WordPress through the REST API, it can use a JSON Web Token (JWT) on later requests. JWT Authentication PRO extends this token workflow with additional ways to sign, refresh, revoke, and monitor tokens.

Token requests and signing

The underlying integration adds the jwt-auth/v1 namespace. Its POST token endpoint accepts a username and password and returns a JWT after successful authentication. Clients can send that token in the Authorization: Bearer header with later API requests. A separate POST endpoint checks a token supplied through that header. The base signing algorithm is HS256; PRO includes options including RS256 and ES256.

Session and access controls

PRO adds endpoints for refreshing and revoking tokens. Refresh can continue a session after a token expires without requiring another login. Revocation lets an application invalidate a token when access should end.

• Admin options and claims: Manage authentication options in the WordPress admin area and add custom claims to the JWT payload.
• CORS controls: Configure allowed origins and headers for cross-origin requests. CORS support can also be enabled through the documented wp-config.php constant.
• Rate limiting: Set limits for requests to help protect endpoints from abuse.
• Logs and monitoring: Review token generation, validation, and errors, with added visibility into authentication activity.
• Priority support: The PRO edition includes priority direct support.

Requirements and setup

The integration is built on WordPress REST API V2 and requires the WP REST API add-on to be installed and activated. The stated minimum PHP version is 7.4.0. The hosting environment must pass the HTTP Authorization Header through to WordPress; some shared hosts disable it by default.

JWT signing requires a unique secret key that must remain confidential. PRO settings are managed through the admin UI. For cross-origin requests, enable CORS as needed and configure the permitted origins and headers.

1. Install and activate the WP REST API add-on.
2. Install and activate JWT Authentication PRO.
3. Open the available settings area and configure the authentication settings.
4. Confirm that the hosting environment passes the HTTP Authorization Header through.
5. Test token creation, validation, refresh, and revocation with the REST API endpoints used by the application.