“I need refresh tokens.”
Token Refresh + Replay DetectionKeep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.
Production-grade JWT Auth for WordPress developers.
JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.
Built on our free JWT plugin — trusted by 60,000+ active installs and backed by a 14-day compatibility guarantee.
HIGH SCORES
= YOUR TOKEN DASHBOARDINSERT TOKENSELECT A PLAYER, THEN HIT REVOKE
1P vs 2P: same game, different ending.
Both add JWT to WordPress. The difference is what happens after the token is issued. The free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly.
1P · FREE FREE FOREVER
Stay on free if you only need to generate and validate tokens for a small project.
MOVES UNLOCKED03/20
2P · PRO STARTS AT $59.99/YR
Upgrade to Pro if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code.
MOVES UNLOCKED20/20 MAX
| Feature | 1P FREE | 2P PRO |
|---|
Six power-ups the free plugin never drops.
Six reasons developers move from free to Pro. Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself.
“I need to revoke any token instantly.”
Instant RevocationRevoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.
“I need automatic protection on credential changes.”
Auto-Revoke RulesTokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.
“I need to see every token at a glance.”
Token Dashboard + GeoIPEvery active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.
“I need API analytics and rate limiting.”
Analytics + Rate LimitingSuccess and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.
“I need a UI instead of custom code.”
Configuration via WP AdminDrop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.
Not just authentication. Complete token control.
Eight bonus stages, all playable from wp-admin. 60 features total.
Stage 1Token Dashboard
Every active token in one view: who owns it, when it was issued, when it expires, last activity. Revoke with one click. This table and the cabinet up top share the same sessions — revoke here and it's game over there.
| Owner | Last used | Status | Action |
|---|
Stage 2 · cheat codeCustom Claims
Add custom claims to JWT tokens using WordPress filters. Drop this in functions.php:
add_filter('jwt_auth_token_before_sign', function($token, $user) {
$token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
$token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
$token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
return $token;
}, 10, 2);Stage 3 · playableRate Limiting & Security Headers
IP-based, 60 req/min (configurable). Mash the button and find the limit. No nginx config required.
00/60 REQ
200 OK
HSTSX-Frame-OptionsXSS protection headers
Stage 4Automatic Revocation Policies
Tokens auto-revoke on password change, email change, or role change. One compromised account doesn't mean open API access.
- Password change on
- Email change on
- Role change on
Stage 5 · replay logSecurity Audit Trail
Complete compliance logging with full context.
- CREATED
- June 13, 2025 3:08 am
- IP
- 110.11.194.83
- UA
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
- HASH
- bb414972b6df2f5a902...
- USER
- John Doe (ID 1)
- LAST USED
- June 13, 2025 3:08 am
- REVOKED
- June 13, 2025 3:08 am
Stage 6 · operator menuAdmin Configuration Interface
The DIP switches moved into WordPress admin.
- JWT token expiration 7 days
- Refresh token expiration 30 days
- Enable CORS on
- Analytics retention 90 days
- Anonymize IP off
Stage 7Usage Analytics
Authentication events, success and failure rates, response times, geographic distribution.
successfailure
Stage 8 · three-button comboGenerate · Validate · Refresh
Works with React, Vue, Flutter, mobile apps, or any client.
- Generate TokenAuthenticate users and issue tokens with a single API call.
POST /wp-json/jwt-auth/v1/token - Validate TokenSignature check, claims validation, expiration status.
POST /wp-json/jwt-auth/v1/token/validate - Refresh TokenAuto renewal, lifecycle management, session continuity.
POST /wp-json/jwt-auth/v1/token/refresh
HS256/384/512RS256/384/512ES256/384/512PS256/384/512EdDSA
Six levels from purchase to production.
No grinding. Here's the whole walkthrough after you buy.
Install Pro
Download the Pro zip from your account, upload through Plugins → Add New.
Activate your license
Paste the key once. Local and staging installs don't count against the quota.
Configure JWT
Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.
Enable Pro features
Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.
Verify in the token dashboard
Hit your API; watch tokens appear live with owner, expiry, IP, country.
14-day compatibility safety net
Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.
Speedrun note: most teams have Pro running before they refill their coffee.
Hall of fame: 60,000+ sites trust our authentication.
Real reviews from WordPress.org.
Select player
Simple, site-based pricing — every plan is full Pro.
Every player starts with
14-day compatibility guarantee on every plan.Local and staging installs are free.One payment, no upsells inside the plugin.Requires PHP 8.1+ and WordPress 5.0+.
How to play
The questions developers ask before they insert a token.
What does Pro do that the free plugin does not?
The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.
Does this plugin work out of the box?
Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.
What happens if Pro does not work on my setup?
Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).
Does a local install count as a site for my license?
No. Local and staging environments do not count against your quota.
Do you offer lifetime access?
Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.
Do you offer a free trial?
No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.
What are the system requirements?
PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.
How does token refresh work?
On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.
What happens to tokens when a user changes password, email, or role?
By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.
What signing algorithms are supported?
HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.
Continue?
The free plugin generates tokens and walks away. Insert Pro to track every token, log every access, and revoke instantly — with a 14-day compatibility guarantee if it can't run on your stack.