Production-grade JWT Auth for WordPress developers.

Free vs Pro, line by line

• FeatureFreePro

• Core Authentication
• Basic JWT Authentication — add login via JSON Web Tokens[X][X]
• Token Generation — issue access tokens on successful auth[X][X]
• Token Validation — verify token integrity on each request[X][X]
• Token Management
• Token Refresh — secure refresh with 64-char tokens and replay attack prevention[ ][X]
• Instant Revocation — revoke compromised sessions immediately[ ][X]
• Token Dashboard — see every active token, owner, expiry, and last activity[ ][X]
• Auto-Revoke on Password Change — all sessions killed when a password is compromised[ ][X]
• Auto-Revoke on Email/Role Change — sessions invalidated on identity or permission changes[ ][X]
• Visibility & Security
• Analytics Dashboard — success/failure rates, response times, 7d/30d/90d history[ ][X]
• GeoIP Tracking — country detection from IP via MaxMind GeoLite2[ ][X]
• Rate Limiting — IP-based, 60 req/min default, configurable, HTTP 429 responses[ ][X]
• Security Headers — automatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection[ ][X]
• Token Family Tracking — detects refresh token replay attacks by tracking token lineage[ ][X]
• Configuration & Compliance
• All Settings via WordPress UI — no wp-config.php editing required[ ][X]
• Configurable Signing Algorithms — HS256, RS256, ES256, EdDSA and more, from the UI[ ][X]
• IP Anonymization — GDPR-compliant option to anonymize stored IP addresses[ ][X]
• Data Retention Policies — configurable 1–365 day retention for analytics and token data[ ][X]
• Support & Developer Tools
• Priority Support — direct help from the developer[ ][X]
• Detailed Documentation — guides, examples, best practices[ ][X]
• 30+ Developer Hooks & Filters — actions and filters for deep integration[ ][X]

• Lines checked03/2020/20
• Price — Free forever (WP.org) / Pro starts at $59.99/yr$0$59.99+

Six reasons developers move from free to Pro

Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself. 6 records follow.

Not just authentication. Complete token control.

Token Dashboard. Every active token in one view: who owns it, when issued, when it expires, last activity. Revoke with one click — select [REVOKE] on any active line and watch the printer strike it out.

• TokenOwnerLast usedStatusAction

• T-0417Jessica SmithJune 13, 2025 3:08 amActive[REVOKE]--------
• T-0388Jane DoeApril 2, 2025 1:40 amRevoked[REVOKE]--------
• T-0291Sam PetersonJanuary 1, 2025 1:40 amExpired[REVOKE]--------
• T-0418Nayeli StrosinJune 13, 2025 3:08 amActive[REVOKE]--------
• T-0409Brett RogahnJune 10, 2025 10:34 amRevoked[REVOKE]--------

Tokens: 5Active: 2Revoked: 2Expired: 1[RERUN REPORT]

Automatic revocation policies. Tokens auto-revoke on password change, email change, or role change. One compromised account doesn't mean open API access.

Custom Claims

Add custom claims to JWT tokens using WordPress filters. Listing of functions.php:

0010  add_filter('jwt_auth_token_before_sign', function($token, $user) {
0020      $token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
0030      $token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
0040      $token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
0050      return $token;
0060  }, 10, 2);

After purchase: six job steps

“Most teams have Pro running before they refill their coffee.”

1. Install Pro

   Download the Pro zip from your account, upload through Plugins → Add New.

2. Activate your license

   Paste the key once. Local and staging installs don't count against the quota.

3. Configure JWT

   Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.

4. Enable Pro features

   Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.

5. Verify in the token dashboard

   Hit your API; watch tokens appear live with owner, expiry, IP, country.

6. 14-day compatibility safety net

   Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.

60,000+ sites trust our authentication

Source file: WordPress.org reviews. 8 records, printed verbatim.

Simple, site-based pricing

Every plan is full Pro. One payment, no upsells inside the plugin.

Terms:[YEARLY][LIFETIME]

• ItemDescriptionSitesAmount

• 001

  Professional Single Site

  Full Pro for one production site.1 site $59.99per year Order
• 002

  Professional Team

  Full Pro across a team's sites.Up to 5 sites $149.99per year Order
• 003

  Professional Agency

  Adds white-labeling.Up to 20 sites $339.99per year Order

Included in every line item

• Token Management Dashboard
• Token Refresh with Replay Detection
• Instant & Auto Revocation
• Usage Analytics (7d/30d/90d)
• Rate Limiting & Security Headers
• GeoIP Tracking
• All settings via UI
• IP Anonymization & Data Retention
• 30+ Developer Hooks & Filters
• Priority Support

Remarks: 14-day compatibility guarantee on every plan. Local and staging installs are free. Requires PHP 8.1+ and WordPress 5.0+.

Q/A log