Doc. WP/JWT/PROIssued by the author of the free plugin

Passport control for every token your WordPress site issues.

Production-grade JWT Auth for WordPress developers. JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.

See Pro plans Compare Free vs Pro

Built on our free JWT plugin — trusted by 60,000+ active installs and backed by a 14-day compatibility guarantee.

WORDPRESS REST API PASSPORT · ACCESS TOKEN

Type: P
Code: WPJ
Token No.: BB414972B6
Holder: SMITH, JESSICA
Algorithm: HS256
Date of issue: 13 JUN 2025
Date of expiry (7 days): 20 JUN 2025
Issuing authority: YOUR-WORDPRESS-SITE.COM
Holder's signature: J. Smith

P<WPJWT<AUTH<PRO<<SMITH<<JESSICA<<<<<<<<<<<<<
BB414972B6<4WPJ2506137HS2562506208<<<<<<<<<06

Active Revoked

Stolen phone? Leaked token? You're the officer.

Without a border agency

The free plugin generates tokens and walks away.

Issued · unmonitored

With JWT Auth Pro

Pro tracks every token, logs every access, and lets you revoke instantly.

Tracked · logged · revocable

Entry rights: tourist visa or diplomatic.

Both add JWT to WordPress. The difference is what happens after the token is issued. Stay on free if you only need to generate and validate tokens for a small project. Upgrade to Pro if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code.

Right conferred	Tourist visaFreeWP.org · Free forever	DiplomaticProstarts at $59.99/yr

3 rights on a tourist visa. 20 with diplomatic status.See Pro plans

Six grounds for upgrading your papers.

Six reasons developers move from free to Pro. Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself.

“I need refresh tokens.”
Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.
Token Refresh + Replay Detection
“I need to revoke any token instantly.”
Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.
Instant Revocation
“I need automatic protection on credential changes.”
Tokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.
Auto-Revoke Rules

“I need to see every token at a glance.”
Every active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.
Token Dashboard + GeoIP
“I need API analytics and rate limiting.”
Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.
Analytics + Rate Limiting
“I need a UI instead of custom code.”
Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.
Configuration via WP Admin

Not just authentication. Complete token control.

Inside the checkpoint: the register, the rule book, the statistics office and the counters your clients queue at.

Token Dashboard

Every active token in one view: who owns it, when it was issued, when it expires, last activity. Revoke with one click — try it.

HolderLast usedStatus

Jessica SmithJune 13, 2025 3:08 amActive

Jane DoeApril 2, 2025 1:40 amRevoked

Sam PetersonJanuary 1, 2025 1:40 amExpired

Nayeli StrosinJune 13, 2025 3:08 amActive

Brett RogahnJune 10, 2025 10:34 amRevoked

A revoked token is turned away before the next request lands.

Standing rule 3Automatic

Automatic Revocation Policies

One compromised account doesn't mean open API access.

Password changeAll of that user's tokens are cancelled.Void
Email changeIdentity changed, papers withdrawn.Void
Role changePermissions changed, papers withdrawn.Void

Endorsements & observationsfunctions.php

Custom Claims

Add custom claims to JWT tokens using WordPress filters. An endorsement, typed straight into the document.

add_filter('jwt_auth_token_before_sign', function($token, $user) {
    $token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
    $token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
    $token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
    return $token;
}, 10, 2);

Endorsement 1: customer_type
Endorsement 2: loyalty_points
Endorsement 3: preferred_currency

Entry / exit recordFull context

Security Audit Trail

Complete compliance logging with full context.

Created: June 13, 2025 3:08 am
IP: 110.11.194.83
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
Hash: bb414972b6df2f5a902...
User: John Doe (ID 1)
Last used: June 13, 2025 3:08 am
Revoked: June 13, 2025 3:08 am

Crossing statisticsSample data

Usage Analytics

Authentication events, success and failure rates, response times, geographic distribution.

admitted (successful auth)refused (failed auth)

Checkpoint capacityPer IP address

Rate Limiting & Security Headers

IP-based, 60 req/min (configurable). No nginx config required.

Request 61 from the same address in the same minute is turned back at the barrier.

Seals applied to every response

Strict-Transport-Security (HSTS)
X-Frame-Options
X-Content-Type-Options
X-XSS-Protection

Standing orderswp-admin

Admin Configuration Interface

Aside from the secret key, every order is given from WordPress admin.

JWT token expiration7 days

Refresh token expiration30 days

Enable CORS

Analytics retention90 days

Anonymize IP

Three countersAny client

Issue, inspect, renew

Works with React, Vue, Flutter, mobile apps, or any client.

Counter A

Generate Token

POST /wp-json/jwt-auth/v1/token

Authenticate users and issue tokens with a single API call.

Counter B

Validate Token

POST /wp-json/jwt-auth/v1/token/validate

Signature check, claims validation, expiration status.

Counter C

Refresh Token

POST /wp-json/jwt-auth/v1/token/refresh

Auto renewal, lifecycle management, session continuity.

HS256/384/512RS256/384/512ES256/384/512PS256/384/512EdDSA 60 features total.

After purchase: six lanes, nothing to declare.

A real sequence, walked in order. Lane six is the way back out if your stack won't cooperate.

Lane
Install Pro
Download the Pro zip from your account, upload through Plugins → Add New.
Lane
Activate your license
Paste the key once. Local and staging installs don't count against the quota.
Lane
Configure JWT
Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.
Lane
Enable Pro features
Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.
Lane
Verify in the token dashboard
Hit your API; watch tokens appear live with owner, expiry, IP, country.
Lane
14-day compatibility safety net
Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.

Most teams have Pro running before they refill their coffee.

60,000+ sites trust our authentication.

From the visitors' book: entries left on WordPress.org by people who came through.

Easy, stable, powerful, extensible

Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!

Name: MadeByCaliper

Perfect to use for API

JWT is brillant and it works out of the box. Further to this is it really stable and does it job.

Name: Steffi

High quality plugin

Delivers what is promised. And that's quite comprehensive list of features. Recommended.

Name: Martin Šenkeřík

Very useful plugin

I'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps

Name: softradeweb

Exactly as described, very easy to use and clear documentation. Thank you

Name: WildPress

Great plugin!

I've been using the plugin for over year, it's very good and user friendly!

Name: Mwale Kalenga

Simply perfect!

I integrated it with my Flutter app, and it works flawlessly.

Name: graficowalab

Perfect

Does exactly what it states! Have been using this plugin for about a year now and haven't had any problems!

Name: xero2112

Three document classes. Every one is full Pro.

Simple, site-based pricing. The class only decides how many sites the document covers.

Class I

Professional Single Site

Valid for 1 site

$59.99per year

Get Single Site

Class II

Professional Team

Valid for up to 5 sites

$149.99per year

Get Team

Class III

Professional Agency

Valid for up to 20 sites · adds white-labeling

$339.99per year

Get Agency

Rights conferred by every class

14-day compatibility guarantee on every plan. Local and staging installs are free. One payment, no upsells inside the plugin.

Requires PHP 8.1+ and WordPress 5.0+.

Token Management Dashboard
Token Refresh with Replay Detection
Instant & Auto Revocation
Usage Analytics (7d/30d/90d)
Rate Limiting & Security Headers
GeoIP Tracking
All settings via UI
IP Anonymization & Data Retention
30+ Developer Hooks & Filters
Priority Support

Customs declaration. Ask us anything.

Tick a box to read the officer's answer.

Form JWT-14 · Declaration of questionsAnswer every item truthfully

What does Pro do that the free plugin does not?

The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.

Does this plugin work out of the box?

Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.

What happens if Pro does not work on my setup?

Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).

Does a local install count as a site for my license?

No. Local and staging environments do not count against your quota.

Do you offer lifetime access?

Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.

Do you offer a free trial?

No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.

What are the system requirements?

PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.

How does token refresh work?

On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.

What happens to tokens when a user changes password, email, or role?

By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.

What signing algorithms are supported?

HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.

Compatibility guaranteed · 14 days

Both add JWT to WordPress. The difference is what happens after the token is issued.

Keep the auth flow you already run. Put a border agency behind it: a register of every token, refresh, instant revocation, an audit trail and a rate limit at the gate.