JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.
Built on our free JWT plugin — trusted by 60,000+ active installs and backed by a 14-day compatibility guarantee.
Below is this page written as a JSON Web Token. Its header says what the product is, its payload lists what Pro carries, and its signature is the proof. Each segment can be decoded.
header.payload.signature
This is a token like the ones your WordPress site issues. Promote yourself to administrator and watch what the signature does about it.
Tampering is the easy case. Both plugins catch it, because both add JWT to WordPress.
The difference is what happens after the token is issued. The free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly.
Stay on free if you only need to generate and validate tokens for a small project. Upgrade to Pro if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code.
Free forever. It issues a token, checks it on each request, and that is the whole payload.
"jwt_authentication": trueBasic JWT Authentication — add login via JSON Web Tokens.
"token_generation": trueIssue access tokens on successful auth.
"token_validation": trueVerify token integrity on each request.
"token_refresh": "64-char"Secure refresh with 64-char tokens and replay attack prevention.
"instant_revocation": trueRevoke compromised sessions immediately.
"token_dashboard": trueSee every active token, owner, expiry, and last activity.
"auto_revoke_on_password_change": trueAll sessions killed when a password is compromised.
"auto_revoke_on_email_role_change": trueSessions invalidated on identity or permission changes.
"analytics_dashboard": "7d/30d/90d"Success/failure rates, response times, 7d/30d/90d history.
"geoip_tracking": "MaxMind GeoLite2"Country detection from IP.
"rate_limiting": "60 req/min"IP-based, 60 req/min default, configurable, HTTP 429 responses.
"security_headers": trueAutomatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection.
"token_family_tracking": trueDetects refresh token replay attacks by tracking token lineage.
"settings_via_wordpress_ui": trueNo wp-config.php editing required.
"signing_algorithms": ["HS256","RS256","ES256","EdDSA", …]Configurable signing algorithms, chosen from the UI.
"ip_anonymization": trueGDPR-compliant option to anonymize stored IP addresses.
"data_retention_policies": "1–365 days"Configurable retention for analytics and token data.
"priority_support": trueDirect help from the developer.
"detailed_documentation": trueGuides, examples, best practices.
"developer_hooks_and_filters": "30+"Actions and filters for deep integration.
Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself.
Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.
+ Token Refresh + Replay Detection
Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.
+ Instant Revocation
Tokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.
+ Auto-Revoke Rules
Every active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.
+ Token Dashboard + GeoIP
Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.
+ Analytics + Rate Limiting
Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.
+ Configuration via WP Admin
Every active token in one view: who owns it, when it was issued, when it expires, last activity. Revoke with one click.
One compromised account doesn't mean open API access.
Add custom claims to JWT tokens using WordPress filters. What you write in functions.php on the left lands in the payload on the right.
// functions.php add_filter('jwt_auth_token_before_sign', function($token, $user) { $token['customer_type'] = get_user_meta($user->ID, 'customer_type', true); $token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true); $token['preferred_currency'] = get_user_meta($user->ID, 'currency', true); return $token; }, 10, 2);
// decoded payload (example values) { "iss": "https://your-site.com", "exp": 1750388880, "customer_type": "wholesale", "loyalty_points": "1280", "preferred_currency": "EUR" }
Authentication events, success and failure rates, response times, geographic distribution.
IP-based, 60 req/min (configurable). No nginx config required.
# request 61 from the same IP, same minute HTTP/1.1 429 Too Many Requests
Complete compliance logging with full context.
Aside from the secret key, every setting lives in WordPress admin.
Works with React, Vue, Flutter, mobile apps, or any client.
POST /wp-json/jwt-auth/v1/tokenAuthenticate users and issue tokens with a single API call.
POST /wp-json/jwt-auth/v1/token/validateSignature check, claims validation, expiration status.
POST /wp-json/jwt-auth/v1/token/refreshAuto renewal, lifecycle management, session continuity.
Download the Pro zip from your account, upload through Plugins → Add New.
Paste the key once. Local and staging installs don't count against the quota.
Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.
Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.
Hit your API; watch tokens appear live with owner, expiry, IP, country.
Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.
Most teams have Pro running before they refill their coffee.
Signed by people who run it. Real reviews from WordPress.org.
Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!
JWT is brillant and it works out of the box. Further to this is it really stable and does it job.
I've been using the plugin for over year, it's very good and user friendly!
Delivers what is promised. And that's quite comprehensive list of features. Recommended.
I integrated it with my Flutter app, and it works flawlessly.
Exactly as described, very easy to use and clear documentation. Thank you
I'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps
Does exactly what it states! Have been using this plugin for about a year now and haven't had any problems!
Same header, same payload. Only the number of sites changes what you sign for.
"sites": 1
Full Pro for one production site.
"sites": "up to 5"
Full Pro across a handful of client or product sites.
"sites": "up to 20", "white_label": true
Full Pro for agencies. Adds white-labeling.
14-day compatibility guarantee on every plan. Local and staging installs are free. One payment, no upsells inside the plugin.
Requires PHP 8.1+ and WordPress 5.0+.
Anything else, ask support. It reaches the plugin author directly.
The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.
Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.
Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).
No. Local and staging environments do not count against your quota.
Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.
No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.
PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.
On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.
By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.
HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.
Keep the auth flow you already have. Add the dashboard, refresh tokens, revocation, audit trail and rate limiting on top, backed by a 14-day compatibility guarantee.