“I need refresh tokens.”
Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.
Detail A — Token Refresh + Replay Detection
Production-grade JWT Auth for WordPress developers.
the missing control layer for the free plugin you already run
JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.
General notes
- Built on our free JWT plugin — trusted by 60,000+ active installs.
- Backed by a 14-day compatibility guarantee.
- Existing auth flow to remain in place. Do not rebuild.
Drag sideways to pan the drawing
- 1Refresh valveSecure 64-character refresh tokens, tracked as a family to detect replay attacks.
- 2Revocation switchRevoke any token in a single click — or automatically on password, email, or role change.
- 3Rate limiterIP-based, 60 req/min default, configurable. HTTP 429 beyond that.
- 4Audit recorderEvery token logged with IP, user agent, hash, owner, last use, and revocation time.
JWT Auth Pro
TitleGeneral arrangement
Drawn byTmeister
Dwg no.A-01
ScaleNTS
RevPro
Sheet1 of 10
Bill of materials: Free vs Pro
Both add JWT to WordPress. The difference is what happens after the token is issued: the free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly.
Stay on Free if…
you only need to generate and validate tokens for a small project.
3 of 20 items suppliedUpgrade to Pro if…
you need to inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code.
all 20 items supplied, fully assembled| Item | Description | Free | Pro |
|---|---|---|---|
| Core authentication | |||
| 1 | Basic JWT AuthenticationAdd login via JSON Web Tokens | ||
| 2 | Token GenerationIssue access tokens on successful auth | ||
| 3 | Token ValidationVerify token integrity on each request | ||
| Token management | |||
| 4 | Token RefreshSecure refresh with 64-char tokens and replay attack prevention | ||
| 5 | Instant RevocationRevoke compromised sessions immediately | ||
| 6 | Token DashboardSee every active token, owner, expiry, and last activity | ||
| 7 | Auto-Revoke on Password ChangeAll sessions killed when a password is compromised | ||
| 8 | Auto-Revoke on Email/Role ChangeSessions invalidated on identity or permission changes | ||
| Visibility & security | |||
| 9 | Analytics DashboardSuccess/failure rates, response times, 7d/30d/90d history | ||
| 10 | GeoIP TrackingCountry detection from IP via MaxMind GeoLite2 | ||
| 11 | Rate LimitingIP-based, 60 req/min default, configurable, HTTP 429 responses | ||
| 12 | Security HeadersAutomatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection | ||
| 13 | Token Family TrackingDetects refresh token replay attacks by tracking token lineage | ||
| Configuration & compliance | |||
| 14 | All Settings via WordPress UINo wp-config.php editing required | ||
| 15 | Configurable Signing AlgorithmsHS256, RS256, ES256, EdDSA and more, from the UI | ||
| 16 | IP AnonymizationGDPR-compliant option to anonymize stored IP addresses | ||
| 17 | Data Retention PoliciesConfigurable 1–365 day retention for analytics and token data | ||
| Support & developer tools | |||
| 18 | Priority SupportDirect help from the developer | ||
| 19 | Detailed DocumentationGuides, examples, best practices | ||
| 20 | 30+ Developer Hooks & FiltersActions and filters for deep integration | ||
| Unit cost | Free forever | From $59.99/yr | |
SuppliedNot supplied — build, debug and maintain yourself
JWT Auth Pro
TitleBill of materials
Drawn byTmeister
Dwg no.A-02
ScaleNTS
RevPro
Sheet2 of 10
Details A–F: six reasons developers move to Pro
Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself.
“I need to revoke any token instantly.”
Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.
Detail B — Instant Revocation
“I need automatic protection on credential changes.”
Tokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.
Detail C — Auto-Revoke Rules
“I need to see every token at a glance.”
Every active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.
Detail D — Token Dashboard + GeoIP
“I need API analytics and rate limiting.”
Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.
Detail E — Analytics + Rate Limiting
“I need a UI instead of custom code.”
Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.
Detail F — Configuration via WP Admin
JWT Auth Pro
TitleDetails A–F
Drawn byTmeister
Dwg no.A-03
ScaleNTS
RevPro
Sheet3 of 10
Token schedule & inspection record
Not just authentication. Complete token control. Every active token in one view: who owns it, when it was issued, when it expires, and its last activity. Revoke with one click.
| Mark | Owner | Last activity | Status | Action |
|---|---|---|---|---|
| T-1 | Jessica Smith | June 13, 2025 3:08 am | Active | |
| T-2 | Jane Doe | April 2, 2025 1:40 am | Revoked | |
| T-3 | Sam Peterson | January 1, 2025 1:40 am | Expired | |
| T-4 | Nayeli Strosin | June 13, 2025 3:08 am | Active | |
| T-5 | Brett Rogahn | June 10, 2025 10:34 am | Revoked |
Security audit trail
Complete compliance logging with full context, kept for every token.
- Created
- June 13, 2025 3:08 am
- IP
- 110.11.194.83
- User agent
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
- Hash
- bb414972b6df2f5a902...
- User
- John Doe (ID 1)
- Last used
- June 13, 2025 3:08 am
- Revoked
- June 13, 2025 3:08 am
GeoIP adds country of origin. IP anonymization is one toggle if GDPR requires it.
JWT Auth Pro
TitleToken schedule
Drawn byTmeister
Dwg no.A-04
Scale1:1
RevPro
Sheet4 of 10
Controls, connections & settings
The rest of the control layer. Works with React, Vue, Flutter, mobile apps, or any client.
Custom claims
Add custom claims to JWT tokens using WordPress filters.
functions.phpadd_filter('jwt_auth_token_before_sign', function($token, $user) {
$token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
$token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
$token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
return $token;
}, 10, 2);Connection points
- Generate token
POST /wp-json/jwt-auth/v1/tokenAuthenticate users and issue tokens with a single API call. - Validate token
/wp-json/jwt-auth/v1/token/validateSignature check, claims validation, expiration status. - Refresh token
/wp-json/jwt-auth/v1/token/refreshAuto renewal, lifecycle management, session continuity.
Usage analytics
Authentication events, success and failure rates, response times, geographic distribution.
SuccessFailureIllustrative trace
Automatic revocation policies
Tokens auto-revoke on password change, email change, or role change. One compromised account doesn't mean open API access.
- Revoke on password change
- Revoke on email change
- Revoke on role change
each rule switches independently; customize with filters
Rate limiting & security headers
IP-based, 60 req/min (configurable), HTTP 429 beyond the limit. No nginx config required.
- HSTS
- X-Frame-Options
- X-Content-Type-Options
- XSS-Protection
Admin configuration interface
Drop your secret key into wp-config.php once. Everything else lives in WordPress admin.
- JWT token expiration7 days
- Refresh token expiration30 days
- Enable CORS
- Analytics retention90 days
- Anonymize IP
- Signing algorithmHS · RS · ES · PS 256/384/512 · EdDSA
JWT Auth Pro
TitleControls & settings
Drawn byTmeister
Dwg no.A-05
ScaleNTS
RevPro
Sheet5 of 10
Assembly instructions
What happens after purchase. Carry out in the order shown. No special tools required.
Install Pro
Download the Pro zip from your account, upload through Plugins → Add New.
Activate your license
Paste the key once. Local and staging installs don't count against the quota.
Configure JWT
Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.
Enable Pro features
Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.
Verify in the token dashboard
Hit your API; watch tokens appear live with owner, expiry, IP, country.
14-day compatibility safety net
Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.
“Most teams have Pro running before they refill their coffee.”
JWT Auth Pro
TitleAssembly instructions
Drawn byTmeister
Dwg no.A-06
ScaleNTS
RevPro
Sheet6 of 10
Field reports: 60,000+ sites trust our authentication
Site notes from WordPress.org reviewers of the free plugin, the foundation Pro is built on.
Perfect to use for API
JWT is brillant and it works out of the box. Further to this is it really stable and does it job.
Easy, stable, powerful, extensible
Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!
High quality plugin
Delivers what is promised. And that's quite comprehensive list of features. Recommended.
Simply perfect!
I integrated it with my Flutter app, and it works flawlessly.
Very useful plugin
I'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps
Exactly as described, very easy to use and clear documentation. Thank you
Great plugin!
I've been using the plugin for over year, it's very good and user friendly!
Perfect
Does exactly what it states! Have been using this plugin for about a year now and haven't had any problems!
JWT Auth Pro
TitleField reports
Drawn byTmeister
Dwg no.A-07
ScaleNTS
RevPro
Sheet7 of 10
Spec plates: simple, site-based pricing
Every plan is full Pro. The only variable is the number of sites.
Term
ProfessionalAgency
- Capacity
- Up to 20 sites
- Rating
- $339.99
- Term
- Per year
- Build
- Full Pro + white-labeling
Supplied with every plate
- Token Management Dashboard
- Token Refresh with Replay Detection
- Instant & Auto Revocation
- Usage Analytics (7d/30d/90d)
- Rate Limiting & Security Headers
- GeoIP Tracking
- All settings via UI
- IP Anonymization & Data Retention
- 30+ Developer Hooks & Filters
- Priority Support
Notes
- 14-day compatibility guarantee on every plan.
- Local and staging installs are free.
- One payment, no upsells inside the plugin.
- Requires PHP 8.1+ and WordPress 5.0+.
- Lifetime option exists on every plan; Team and Agency lifetime pricing shown at checkout.
JWT Auth Pro
TitleSpec plates
Drawn byTmeister
Dwg no.A-08
Scale1:1
RevPro
Sheet8 of 10
Requests for information
Queries raised against this drawing set, with the author's responses.
What does Pro do that the free plugin does not?
The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.
Does this plugin work out of the box?
Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.
What happens if Pro does not work on my setup?
Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).
Does a local install count as a site for my license?
No. Local and staging environments do not count against your quota.
Do you offer lifetime access?
Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.
Do you offer a free trial?
No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.
What are the system requirements?
PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.
How does token refresh work?
On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.
What happens to tokens when a user changes password, email, or role?
By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.
What signing algorithms are supported?
HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.
JWT Auth Pro
TitleRequests for information
Drawn byTmeister
Dwg no.A-09
ScaleNTS
RevPro
Sheet9 of 10
Issued for production.
Track every token, log every access, revoke instantly — on the JWT plugin you're already running. Installed before the coffee is refilled, and covered by a 14-day compatibility guarantee.
JWT Auth Pro
TitleRelease
Drawn byTmeister
Dwg no.A-10
ScaleNTS
RevPro
Sheet10 of 10