Get it now

The screen below is live. Click things.

Production-grade JWT Auth for WordPress developers. Try it first.

JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.

See Pro plansCompare Free vs Pro
  • Three things to try:
  • Revoke a token
  • Change a user's password
  • Send a burst past the rate limit
shop.example.test Demo data, simulated in your browser

Tokens

every token, who holds it, and a button to end it
Active tokens6
Requests48/min
Success rate today96.0%
Blocked with 4290

Token dashboard

OwnerIssuedExpiresLast activityCountryStatusAction

Auto-revoke rules

Revoke every token a user holds when their…
Test the rule:

Incoming API requests

    Analytics

    –success
    –failure
    –avg response
    7 days ago today

    Rate limit

    IP 203.0.113.42
    14 / 60 requests this minute

    Under the limit. Requests pass.

    60,000+ active installs of the free plugin this is built on14-day compatibility guarantee on every plan

    Both add JWT to WordPress. The difference is what happens after the token is issued.

    The free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly.

    Free plugin Free forever
    unknownTokens issued
    unknownActive sessions
    n/aRevoke
    Nothing to see.Tokens issued: unknown. There is no screen for this.
    JWT Auth Pro starts at $59.99/yr
    5Tokens tracked
    2Active sessions
    1 clickRevoke
    Jessica SmithJune 13, 2025 3:08 amActive
    Jane DoeApril 2, 2025 1:40 amRevoked
    Sam PetersonJanuary 1, 2025 1:40 amExpired
    Nayeli StrosinJune 13, 2025 3:08 amActive
    Brett RogahnJune 10, 2025 10:34 amRevoked

    Stay on free if you only need to generate and validate tokens for a small project.

    Upgrade to Pro if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production, from the WP admin, without custom code.

    FeatureFreeWP.orgProfrom $59.99/yr

    Six reasons developers move from free to Pro

    Each is something the free plugin doesn't ship with, and something you'd otherwise build, debug, and maintain yourself.

    “I need refresh tokens.”

    Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.

    Token Refresh + Replay Detection

    “I need to revoke any token instantly.”

    Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.

    Instant Revocation

    “I need automatic protection on credential changes.”

    Tokens auto-revoke when a user changes their password, email, or role, so one leaked credential never leaves the API wide open.

    Auto-Revoke Rules

    “I need to see every token at a glance.”

    Every active token in one dashboard: owner, expiry, last activity, country of origin. No more guessing which app still holds a session.

    Token Dashboard + GeoIP

    “I need API analytics and rate limiting.”

    Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.

    Analytics + Rate Limiting

    “I need a UI instead of custom code.”

    Drop your secret key into wp-config.php once. Everything else (signing algorithm, token lifetime, CORS, retention policy) lives in WordPress admin instead of code.

    Configuration via WP Admin

    Not just authentication. Complete token control.

    You've used the dashboard, the analytics and the rate limiter at the top of this page. Here is the rest of what ships in the same plugin.

    Custom claims

    Add custom claims to JWT tokens using WordPress filters. Your client reads them straight from the payload.

    functions.php
    add_filter('jwt_auth_token_before_sign', function($token, $user) {
    $token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
    $token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
    $token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
    return $token;
}, 10, 2);
    resulting payload (example values)
    {
  "customer_type": "wholesale",
  "loyalty_points": "1240",
  "preferred_currency": "EUR"
  // …plus the standard claims
}

    Security audit trail

    Complete compliance logging with full context, per token.

    User
    John Doe (ID 1)
    Created
    June 13, 2025 3:08 am
    IP
    110.11.194.83
    User agent
    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
    Hash
    bb414972b6df2f5a902...
    Last used
    June 13, 2025 3:08 am
    Revoked
    June 13, 2025 3:08 am

    Admin configuration interface

    Aside from the secret key in wp-config.php, every setting is a field in WordPress admin. These work, try them.

    Rate limiting & security headers

    IP-based, 60 requests per minute by default and configurable, with automatic HSTS, X-Frame-Options and XSS protection headers. No nginx config required.

    HTTP/1.1 429 Too Many Requests
Strict-Transport-Security: max-age=31536000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

    Three endpoints, any client

    Works with React, Vue, Flutter, mobile apps, or any client.

    Generate tokenPOST /wp-json/jwt-auth/v1/tokenAuthenticate users and issue tokens with a single API call.
    Validate tokenPOST /wp-json/jwt-auth/v1/token/validateSignature check, claims validation, expiration status.
    Refresh tokenPOST /wp-json/jwt-auth/v1/token/refreshAuto renewal, lifecycle management, session continuity.

    Signing algorithms, picked from a dropdown

    HS256HS384HS512RS256RS384RS512ES256ES384ES512PS256PS384PS512EdDSA
    60

    features in total, including 30+ developer hooks and filters.

    Token dashboard, usage analytics, automatic revocation policies

    Every active token in one view: who owns it, when it was issued, when it expires, last activity. Tokens auto-revoke on password, email, or role change, so one compromised account doesn't mean open API access.

    Back to the live console

    From purchase to a live token dashboard in six steps

    No migration. Pro sits on top of the auth flow you already have.

    1. Install Pro

      Download the Pro zip from your account, upload through Plugins → Add New.

    2. Activate your license

      Paste the key once. Local and staging installs don't count against the quota.

    3. Configure JWT

      Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS and retention from the admin UI.

    4. Enable Pro features

      Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.

    5. Verify in the token dashboard

      Hit your API; watch tokens appear live with owner, expiry, IP, country.

    6. 14-day compatibility safety net

      Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.

    Most teams have Pro running before they refill their coffee.

    60,000+ sites trust our authentication

    Reviews of the free plugin on WordPress.org, the foundation Pro is built on.

    Easy, stable, powerful, extensible

    Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!
    MadeByCaliper · WP.org

    Perfect to use for API

    JWT is brillant and it works out of the box. Further to this is it really stable and does it job.
    Steffi · WP.org

    High quality plugin

    Delivers what is promised. And that's quite comprehensive list of features. Recommended.
    Martin Šenkeřík · WP.org

    Simply perfect!

    I integrated it with my Flutter app, and it works flawlessly.
    graficowalab · WP.org

    Very useful plugin

    I'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps
    softradeweb · WP.org
    Exactly as described, very easy to use and clear documentation. Thank you
    WildPress · WP.org

    Great plugin!

    I've been using the plugin for over year, it's very good and user friendly!
    Mwale Kalenga · WP.org

    Perfect

    Does exactly what it states! Have been using this plugin for about a year now and haven't had any problems!
    xero2112 · WP.org

    Simple, site-based pricing. Every plan is full Pro.

    Professional Single Site

    1 site
    $59.99
    per year
    Get Single Site

     

    Professional Team

    Up to 5 sites
    $149.99
    per year
    Get Team

     

    Professional Agency

    Up to 20 sites
    $339.99
    per year
    Get Agency

    Adds white-labeling.

    Every plan includes

    • Token Management Dashboard
    • Token Refresh with Replay Detection
    • Instant & Auto Revocation
    • Usage Analytics (7d/30d/90d)
    • Rate Limiting & Security Headers
    • GeoIP Tracking
    • All settings via UI
    • IP Anonymization & Data Retention
    • 30+ Developer Hooks & Filters
    • Priority Support

    14-day compatibility guarantee on every plan. Local and staging installs are free. One payment, no upsells inside the plugin. Requires PHP 8.1+ and WordPress 5.0+.

    Questions, answered straight

    Still unsure whether Pro runs on your stack? That is exactly what the 14-day guarantee is for.

    What does Pro do that the free plugin does not?

    The free plugin issues and validates JWT tokens, and that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.

    Does this plugin work out of the box?

    Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.

    What happens if Pro does not work on my setup?

    Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).

    Does a local install count as a site for my license?

    No. Local and staging environments do not count against your quota.

    Do you offer lifetime access?

    Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.

    Do you offer a free trial?

    No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.

    What are the system requirements?

    PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.

    How does token refresh work?

    On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.

    What happens to tokens when a user changes password, email, or role?

    By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.

    What signing algorithms are supported?

    HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.

    You revoked a demo token. Now do it on your own site.

    Built on our free JWT plugin, trusted by 60,000+ active installs and backed by a 14-day compatibility guarantee.

    See Pro plansCompare Free vs Pro