Free
Tokens are issued and validated. After that, you can't see through.
Stay on free if you only need to generate and validate tokens for a small project.
Free forever · WP.orgProduction-gradeJWT Auth forWordPress developers.
JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.
60,000+active installs of the free plugin
14 daysBuilt on our free JWT plugin and backed by a compatibility guarantee.
Every token, held up to the light. Pull one out of the stack.
Both add JWT to WordPress. The difference is what happens after the token is issued.
The free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly.Two panes of glass.
Same tokens behind them.
The tokens drifting past below are identical on both sides. Free is frosted: they exist, but you can't see through. Pro is clear: you see every token.
Pro
See every token: owner, expiry, last activity, country of origin.
Upgrade if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production, from the WP admin, without custom code.
Starts at $59.99/yrSix reasons developers move from free to Pro.
Each is something the free plugin doesn't ship with, and something you'd otherwise build, debug, and maintain yourself.
I need refresh tokens.
Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.
Token Refresh + Replay DetectionI need to revoke any token instantly.
Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.
Instant RevocationI need automatic protection on credential changes.
Tokens auto-revoke when a user changes their password, email, or role, so one leaked credential never leaves the API wide open.
Auto-Revoke RulesI need to see every token at a glance.
Every active token in one dashboard: owner, expiry, last activity, country of origin. No more guessing which app still holds a session.
Token Dashboard + GeoIPI need API analytics and rate limiting.
Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.
Analytics + Rate LimitingI need a UI instead of custom code.
Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.
Configuration via WP AdminNot just authentication.
Complete token control.
Sixty features in all. These are the ones you'll open wp-admin for.
Token Dashboard
Every active token in one view: who owns it, when it was issued, when it expires, last activity. Revoke with one click.
UserLast usedStatusAction
Rate Limiting & Security Headers
IP-based and configurable. Past the limit, requests get an HTTP 429. No nginx config required.
HSTSX-Frame-OptionsX-Content-Type-OptionsXSS-Protection
Usage Analytics
Authentication events, success and failure rates, response times, geographic distribution.
Successful authFailed authResponse timesample data
Automatic Revocation Policies
One compromised account doesn't mean open API access. Each rule toggles independently.
- Password changerevoke all
- Email changerevoke all
- Role changerevoke all
Custom Claims
Add custom claims to JWT tokens using WordPress filters. This goes in functions.php.
add_filter('jwt_auth_token_before_sign', function($token, $user) {
$token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
$token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
$token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
return $token;
}, 10, 2);
decoded payload, after signing (example values)
"customer_type" "wholesale""loyalty_points" "1250""preferred_currency" "EUR"
Security Audit Trail
Complete compliance logging with full context.
- created
- June 13, 2025 3:08 am
- ip
- 110.11.194.83
- agent
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
- hash
- bb414972b6df2f5a902...
- user
- John Doe (ID 1)
- last used
- June 13, 2025 3:08 am
- revoked
- June 13, 2025 3:08 am
Admin Configuration Interface
Aside from the secret key in wp-config.php, every setting lives in WordPress admin.
JWT token expiration 7 days
Refresh token expiration 30 days
Analytics retention 90 days
Signing algorithm HS256
Three calls. Any client.
Works with React, Vue, Flutter, mobile apps, or any client.
Generate
POST /wp-json/jwt-auth/v1/tokenAuthenticate users and issue tokens with a single API call.
Validate
/token/validateSignature check, claims validation, expiration status.
Refresh
/token/refreshAuto renewal, lifecycle management, session continuity.
Signing algorithms, picked from the UI:HS256HS384HS512RS256RS384RS512ES256ES384ES512PS256PS384PS512EdDSA
After purchase: six steps, one beam of light.
From zip file to live tokens in the dashboard. Each step hands off to the next.
Install Pro
Download the Pro zip from your account, upload through Plugins → Add New.
Activate your license
Paste the key once. Local and staging installs don't count against the quota.
Configure JWT
Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.
Enable Pro features
Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.
Verify in the token dashboard
Hit your API; watch tokens appear live with owner, expiry, IP, country.
14-day compatibility safety net
Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.
Most teams have Pro running before they refill their coffee.
60,000+ sites trust our authentication.
Reviews of the free plugin on WordPress.org, the foundation Pro is built on.
Easy, stable, powerful, extensible
Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!
Perfect to use for API
JWT is brillant and it works out of the box. Further to this is it really stable and does it job.
Exactly as described, very easy to use and clear documentation. Thank you
High quality plugin
Delivers what is promised. And that's quite comprehensive list of features. Recommended.
Simply perfect!
I integrated it with my Flutter app, and it works flawlessly.
Very useful plugin
I'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps
Great plugin!
I've been using the plugin for over year, it's very good and user friendly!
Perfect
Does exactly what it states! Have been using this plugin for about a year now and haven't had any problems!
Three slabs of the same glass.
Simple, site-based pricing — every plan is full Pro. The only thing that gets thicker is the number of sites.
Professional Single Site
1 site
Get Single SiteProfessional Team
Up to 5 sites
Get TeamProfessional Agency
Up to 20 sites · adds white-labeling
Get AgencyEvery plan includes
14-day compatibility guarantee on every plan. Local and staging installs are free. One payment, no upsells inside the plugin.
Requires PHP 8.1+ and WordPress 5.0+
- Token Management Dashboard
- Token Refresh with Replay Detection
- Instant & Auto Revocation
- Usage Analytics (7d/30d/90d)
- Rate Limiting & Security Headers
- GeoIP Tracking
- All settings via UI
- IP Anonymization & Data Retention
- 30+ Developer Hooks & Filters
- Priority Support
Questions, answered clearly.
Still unsure whether Pro runs on your stack? That's exactly what the 14-day compatibility guarantee is for.
What does Pro do that the free plugin does not?
The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.
Does this plugin work out of the box?
Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.
What happens if Pro does not work on my setup?
Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).
Does a local install count as a site for my license?
No. Local and staging environments do not count against your quota.
Do you offer lifetime access?
Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.
Do you offer a free trial?
No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.
What are the system requirements?
PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.
How does token refresh work?
On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.
What happens to tokens when a user changes password, email, or role?
By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.
What signing algorithms are supported?
HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.
Stop issuing tokens into the fog.
Keep the auth flow you already run. Add the pane of clear glass in front of it: track every token, log every access, revoke instantly.