JWT Auth Pro — Couture

After the token.

The free plugin generates tokens and walks away. It is honest, well-cut work, and for a small project — one that only needs to generate and validate tokens — it is all the wardrobe you require. Stay on free.

Production is another season entirely. A token, once issued, is out in the world: on a phone, in a single-page app, inside somebody's Flutter build. The question is no longer whether you can make one. It is whether you can see it, renew it, and take it back.

Pro tracks every token, logs every access, and lets you revoke instantly. It lets you inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code, and without rebuilding the auth flow you already have.

Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!

The Index

Free and Pro, line by line.

Stay on free if you only need to generate and validate tokens for a small project. Upgrade to Pro if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production.

Feature	FreeWP.org	Profrom $59.99/yr
Core Authentication
Basic JWT AuthenticationAdd login via JSON Web Tokens	Yes	Yes
Token GenerationIssue access tokens on successful auth	Yes	Yes
Token ValidationVerify token integrity on each request	Yes	Yes
Token Management
Token RefreshSecure refresh with 64-char tokens and replay attack prevention	No	Yes
Instant RevocationRevoke compromised sessions immediately	No	Yes
Token DashboardSee every active token, owner, expiry, and last activity	No	Yes
Auto-Revoke on Password ChangeAll sessions killed when a password is compromised	No	Yes
Auto-Revoke on Email/Role ChangeSessions invalidated on identity or permission changes	No	Yes
Visibility & Security
Analytics DashboardSuccess/failure rates, response times, 7d/30d/90d history	No	Yes
GeoIP TrackingCountry detection from IP via MaxMind GeoLite2	No	Yes
Rate LimitingIP-based, 60 req/min default, configurable, HTTP 429 responses	No	Yes
Security HeadersAutomatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection	No	Yes
Token Family TrackingDetects refresh token replay attacks by tracking token lineage	No	Yes
Configuration & Compliance
All Settings via WordPress UINo wp-config.php editing required	No	Yes
Configurable Signing AlgorithmsHS256, RS256, ES256, EdDSA and more, from the UI	No	Yes
IP AnonymizationGDPR-compliant option to anonymize stored IP addresses	No	Yes
Data Retention PoliciesConfigurable 1–365 day retention for analytics and token data	No	Yes
Support & Developer Tools
Priority SupportDirect help from the developer	No	Yes
Detailed DocumentationGuides, examples, best practices	No	Yes
30+ Developer Hooks & FiltersActions and filters for deep integration	No	Yes
The price of admission	Free forever	Starts at $59.99/yr

The Collection

Six reasons developers move from free to Pro.

Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself.

Look 1Token Refresh + Replay Detection

“I need refresh tokens.”

Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.

Look 2Instant Revocation

“I need to revoke any token instantly.”

Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.

Look 3Auto-Revoke Rules

“I need automatic protection on credential changes.”

Tokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.

Look 4Token Dashboard + GeoIP

“I need to see every token at a glance.”

Every active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.

Look 5Analytics + Rate Limiting

“I need API analytics and rate limiting.”

Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.

Look 6Configuration via WP Admin

“I need a UI instead of custom code.”

Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.

Front Row

The token dashboard, as a seating chart.

Every active token in one view: who owns it, when it was issued, when it expires, last activity. Revoke with one click — the seat is empty before the next request lands.

Two seated, two shown out, one lapsed.

Seat A1Token

Jessica Smith

Last used June 13, 2025 3:08 am

Active

Seat A2Token

Jane Doe

Last used April 2, 2025 1:40 am

Revoked

Seat A3Token

Sam Peterson

Last used January 1, 2025 1:40 am

Expired

The Runway/wp-json/jwt-auth/v1

Seat B1Token

Nayeli Strosin

Last used June 13, 2025 3:08 am

Active

Seat B2Token

Brett Rogahn

Last used June 10, 2025 10:34 am

Revoked

Complete control.

Not just authentication. Complete token control.

Seven plates. Turn the page.

// functions.php
add_filter('jwt_auth_token_before_sign', function($token, $user) {
    $token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
    $token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
    $token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
    return $token;
}, 10, 2);

Plate I — Made to measure

Custom Claims

Add custom claims to JWT tokens using WordPress filters. One filter in functions.php, and the token carries what your client needs: customer type, loyalty points, preferred currency.

30+ developer hooks and filters for everything else.

Plate II — Change one, lose all

Automatic Revocation Policies

Tokens auto-revoke on password change, email change, or role change. One compromised account doesn't mean open API access.

Each rule can be toggled independently and customized with filters.

User: John Doe (ID 1)
Created: June 13, 2025 3:08 am
IP: 110.11.194.83
Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
Hash: bb414972b6df2f5a902...
Last used: June 13, 2025 3:08 am
Revoked: June 13, 2025 3:08 am

Plate III — Provenance

Security Audit Trail

Complete compliance logging with full context. Every token keeps its papers: who, when, from where, with what, and the moment it was withdrawn.

requests per minute, per IP. Then, HTTP 429.

Plate IV — The velvet limit

Rate Limiting & Security Headers

IP-based, 60 req/min by default and configurable. Automatic security headers on every response. No nginx config required.

Strict-Transport-Security (HSTS)
X-Frame-Options
X-Content-Type-Options
XSS-Protection

JWT token expiration7 days
Refresh token expiration30 days
Enable CORS
Analytics retention90 days
Anonymize IP

Plate V — The atelier

Admin Configuration Interface

Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.

Plate VI — The numbers

Usage Analytics

Authentication events, success and failure rates, response times, geographic distribution. Read the season in 7-day, 30-day, and 90-day windows.

GeoIP country detection via MaxMind GeoLite2; IP anonymization and 1–365 day retention when compliance asks.

Generate
Authenticate users and issue tokens with a single API call.
POST /wp-json/jwt-auth/v1/token
Validate
Signature check, claims validation, expiration status.
POST /wp-json/jwt-auth/v1/token/validate
Refresh
Auto renewal, lifecycle management, session continuity.
POST /wp-json/jwt-auth/v1/token/refresh

Plate VII — Ready-to-wear

Three calls, any client

Works with React, Vue, Flutter, mobile apps, or any client.

Signing algorithms: HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA — chosen from the UI. Sixty features in all.

1 / 7

The Fitting

After purchase, six steps — in this order.

Most teams have Pro running before they refill their coffee.

Install Pro
Download the Pro zip from your account, upload through Plugins → Add New.
Activate your license
Paste the key once. Local and staging installs don't count against the quota.
Configure JWT
Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.
Enable Pro features
Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.
Verify in the token dashboard
Hit your API; watch tokens appear live with owner, expiry, IP, country.
14-day compatibility safety net
Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.

60,000+ sites trust our authentication

I integrated it with my Flutter app, and it works flawlessly.

JWT is brillant and it works out of the box. Further to this is it really stable and does it job.

I'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps

Exactly as described, very easy to use and clear documentation. Thank you

I've been using the plugin for over year, it's very good and user friendly!

Does exactly what it states! Have been using this plugin for about a year now and haven't had any problems!

The Lookbook

Simple, site-based pricing — every plan is full Pro.

Single Site1 site

Professional Single Site

$59.99

per year

Choose Single Site

TeamUp to 5 sites

Professional Team

$149.99

per year

Choose Team

AgencyUp to 20 sites

Professional Agency

$339.99

per year — adds white-labeling

Choose Agency

Every piece includes

14-day compatibility guarantee on every plan. Local and staging installs are free. One payment, no upsells inside the plugin.

Requires PHP 8.1+ and WordPress 5.0+.

Token Management Dashboard
Token Refresh with Replay Detection
Instant & Auto Revocation
Usage Analytics (7d/30d/90d)
Rate Limiting & Security Headers
GeoIP Tracking
All settings via UI
IP Anonymization & Data Retention
30+ Developer Hooks & Filters
Priority Support

Q & A

Asked, and answered plainly.

What does Pro do that the free plugin does not?

The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.

Does this plugin work out of the box?

Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.

What happens if Pro does not work on my setup?

Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).

Does a local install count as a site for my license?

No. Local and staging environments do not count against your quota.

Do you offer lifetime access?

Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.

Do you offer a free trial?

No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.

What are the system requirements?

PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.

How does token refresh work?

On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.

What happens to tokens when a user changes password, email, or role?

By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.

What signing algorithms are supported?

HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.