Production-grade JWT Auth for WordPress developers.
JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.
Built on our free JWT plugin — trusted by 60,000+ active installs and backed by a 14-day compatibility guarantee.
Both add JWT to WordPress. The difference is the door.
The free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly.
Free · Free forever
Stay on free if you only need to generate and validate tokens for a small project.
Pro · starts at $59.99/yr
Upgrade to Pro if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code.
| What's checked at the door | Open doorFree (WP.org) | Door policyPro |
|---|---|---|
| Core Authentication | ||
| Basic JWT AuthenticationAdd login via JSON Web Tokens | Yes | Yes |
| Token GenerationIssue access tokens on successful auth | Yes | Yes |
| Token ValidationVerify token integrity on each request | Yes | Yes |
| Token Management | ||
| Token RefreshSecure refresh with 64-char tokens and replay attack prevention | No | Yes |
| Instant RevocationRevoke compromised sessions immediately | No | Yes |
| Token DashboardSee every active token, owner, expiry, and last activity | No | Yes |
| Auto-Revoke on Password ChangeAll sessions killed when a password is compromised | No | Yes |
| Auto-Revoke on Email/Role ChangeSessions invalidated on identity or permission changes | No | Yes |
| Visibility & Security | ||
| Analytics DashboardSuccess/failure rates, response times, 7d/30d/90d history | No | Yes |
| GeoIP TrackingCountry detection from IP via MaxMind GeoLite2 | No | Yes |
| Rate LimitingIP-based, 60 req/min default, configurable, HTTP 429 responses | No | Yes |
| Security HeadersAutomatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection | No | Yes |
| Token Family TrackingDetects refresh token replay attacks by tracking token lineage | No | Yes |
| Configuration & Compliance | ||
| All Settings via WordPress UINo wp-config.php editing required | No | Yes |
| Configurable Signing AlgorithmsHS256, RS256, ES256, EdDSA and more, from the UI | No | Yes |
| IP AnonymizationGDPR-compliant option to anonymize stored IP addresses | No | Yes |
| Data Retention PoliciesConfigurable 1–365 day retention for analytics and token data | No | Yes |
| Support & Developer Tools | ||
| Priority SupportDirect help from the developer | No | Yes |
| Detailed DocumentationGuides, examples, best practices | No | Yes |
| 30+ Developer Hooks & FiltersActions and filters for deep integration | No | Yes |
| Cover charge | Free forever | From $59.99/yr |
Six reasons developers move from free to Pro.
Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself.
"I need refresh tokens."Nº 000001
Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.
Token Refresh + Replay Detection"I need to revoke any token instantly."Nº 000002
Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.
Instant Revocation"I need automatic protection on credential changes."Nº 000003
Tokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.
Auto-Revoke Rules"I need to see every token at a glance."Nº 000004
Every active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.
Token Dashboard + GeoIP"I need API analytics and rate limiting."Nº 000005
Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.
Analytics + Rate Limiting"I need a UI instead of custom code."Nº 000006
Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.
Configuration via WP AdminNot just authentication. Complete token control.
Every token is a wristband. Pro is the one holding the clipboard: it knows who is wearing which, when they were last seen, and it carries scissors.
click a name to cross it off & cut the wristband ↓
Every active token in one view: who owns it, when it was issued, when it expires, last activity. Revoke with one click.
No digging through the database, no custom endpoint. The session is over before the next request lands.
Go on — cross somebody off.
Custom Claims
Add custom claims to JWT tokens using WordPress filters. Whatever your client needs to know travels with the wristband.
// functions.php
add_filter('jwt_auth_token_before_sign', function($token, $user) {
$token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
$token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
$token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
return $token;
}, 10, 2);Automatic Revocation Policies
Tokens auto-revoke on password change, email change, or role change. One compromised account doesn't mean open API access.
Rate Limiting & Security Headers — 60 per minute
IP-based, 60 requests a minute by default, configurable. Number 61 waits outside with an HTTP 429. No nginx config required.
+ automatic HSTS · X-Frame-Options · X-Content-Type-Options · XSS-Protection
Security Audit Trail
Complete compliance logging with full context — for every wristband ever handed out.
Admin Configuration Interface
All of it in WordPress admin. No wp-config.php editing beyond the secret key.
Usage Analytics
Authentication events, success and failure rates, response times, geographic distribution.
Illustrative chart — cyan lets in, magenta turns away.
Works with React, Vue, Flutter, mobile apps, or any client
Authenticate users and issue tokens with a single API call.
POST /wp-json/jwt-auth/v1/tokenSignature check, claims validation, expiration status.
POST /wp-json/jwt-auth/v1/token/validateAuto renewal, lifecycle management, session continuity.
POST /wp-json/jwt-auth/v1/token/refreshSigning algorithms: HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA. 60 features in total.
60,000+ sites trust our authentication.
Real reviews from WordPress.org, pasted up where everyone can read them.
JWT is brillant and it works out of the box. Further to this is it really stable and does it job.
I integrated it with my Flutter app, and it works flawlessly.
Delivers what is promised. And that's quite comprehensive list of features. Recommended.
Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!
Exactly as described, very easy to use and clear documentation. Thank you
I'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps
I've been using the plugin for over year, it's very good and user friendly!
Does exactly what it states! Have been using this plugin for about a year now and haven't had any problems!
Simple, site-based pricing — every plan is full Pro.
Three passes, one difference: how many sites you're running the door for.
14-day compatibility guarantee on every plan. Local and staging installs are free. One payment, no upsells inside the plugin.
Requires PHP 8.1+ and WordPress 5.0+.
Straight answers before you queue.
The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.
Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.
Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).
No. Local and staging environments do not count against your quota.
Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.
No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.
PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.
On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.
By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.
HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.
You're on the list.
The free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly — backed by a 14-day compatibility guarantee.