Welcome to JWT Auth Pro

JWT Auth Pro · for the WordPress REST API

Production-grade JWT Auth for WordPress developers.

JWT Auth Pro adds the missing control layer to the free JWT plugin you’re already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.

See Pro plans Compare Free vs Pro

Token Manager

5 tokens, 2 active
Select a token, then Revoke — or drag it to the trash.

About JWT Auth Pro

Built on our free JWT plugin — trusted by 60,000+ active installs and backed by a 14-day compatibility guarantee.

Tokens Free vs Pro Install Pro Price List

Free vs Pro — Worksheet

A1

Both add JWT to WordPress. The difference is what happens after the token is issued.

ABC
FeatureStay on free to generate and validate tokens for a small project. Upgrade to inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code.FreeWP.org
Free forever		Prostarts at $59.99/yr
Core Authentication
Basic JWT Authentication — add login via JSON Web TokensYesYes
Token Generation — issue access tokens on successful authYesYes
Token Validation — verify token integrity on each requestYesYes
Token Management
Token Refresh — secure refresh with 64-char tokens and replay attack preventionNoYes
Instant Revocation — revoke compromised sessions immediatelyNoYes
Token Dashboard — see every active token, owner, expiry, and last activityNoYes
Auto-Revoke on Password Change — all sessions killed when a password is compromisedNoYes
Auto-Revoke on Email/Role Change — sessions invalidated on identity or permission changesNoYes
Visibility & Security
Analytics Dashboard — success/failure rates, response times, 7d/30d/90d historyNoYes
GeoIP Tracking — country detection from IP via MaxMind GeoLite2NoYes
Rate Limiting — IP-based, 60 req/min default, configurable, HTTP 429 responsesNoYes
Security Headers — automatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-ProtectionNoYes
Token Family Tracking — detects refresh token replay attacks by tracking token lineageNoYes
Configuration & Compliance
All Settings via WordPress UI — no wp-config.php editing requiredNoYes
Configurable Signing Algorithms — HS256, RS256, ES256, EdDSA and more, from the UINoYes
IP Anonymization — GDPR-compliant option to anonymize stored IP addressesNoYes
Data Retention Policies — configurable 1–365 day retention for analytics and token dataNoYes
Support & Developer Tools
Priority Support — direct help from the developerNoYes
Detailed Documentation — guides, examples, best practicesNoYes
30+ Developer Hooks & Filters — actions and filters for deep integrationNoYes
20 featuresFree forever: 3 · Pro from $59.99/yr: 20

Reasons to Upgrade

6 itemsEach is something the free plugin doesn’t ship with — and you’d otherwise build, debug, and maintain yourself.

  • “I need refresh tokens.”

    Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.

    Token Refresh + Replay Detection

  • “I need to revoke any token instantly.”

    Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.

    Instant Revocation

  • “I need automatic protection on credential changes.”

    Tokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.

    Auto-Revoke Rules

  • “I need to see every token at a glance.”

    Every active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.

    Token Dashboard + GeoIP

  • “I need API analytics and rate limiting.”

    Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.

    Analytics + Rate Limiting

  • “I need a UI instead of custom code.”

    Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.

    Configuration via WP Admin

functions.php — Editor

add_filter('jwt_auth_token_before_sign', function($token, $user) {
    $token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
    $token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
    $token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
    return $token;
}, 10, 2);

Custom Claims

Add custom claims to JWT tokens using WordPress filters. Not just authentication — complete token control.

PHPLn 6, Col 12

Control Panel

Admin Configuration Interface: aside from the secret key, every setting lives in wp-admin.

  • JWT token expiration7 days
  • Refresh token expiration30 days
  • Analytics retention90 days

Automatically revoke tokens on

One compromised account doesn’t mean open API access.

Token Info

Security Audit Trail

Complete compliance logging with full context.

Created
June 13, 2025 3:08 am
IP
110.11.194.83
User agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
Hash
bb414972b6df2f5a902...
User
John Doe (ID 1)
Last used
June 13, 2025 3:08 am
Revoked
June 13, 2025 3:08 am

Usage Analytics — Paint

Authentication events SuccessFailure Response time

Usage Analytics

Authentication events, success and failure rates, response times, geographic distribution; 7-day, 30-day, 90-day windows. The drawing above is sample data — pick a fill pattern.

Network

Three calls. Any client.

Works with React, Vue, Flutter, mobile apps, or any client.

  • Generate Token

    POST /wp-json/jwt-auth/v1/token

    Authenticate users and issue tokens with a single API call.

  • Validate Token

    POST /wp-json/jwt-auth/v1/token/validate

    Signature check, claims validation, expiration status.

  • Refresh Token

    POST /wp-json/jwt-auth/v1/token/refresh

    Auto renewal, lifecycle management, session continuity.

Rate Limiting & Security Headers

60 req/min

IP-based and configurable, with HTTP 429 beyond the limit. Automatic security headers on every response. No nginx config required.

  • HSTS
  • X-Frame-Options
  • X-Content-Type-Options
  • XSS-Protection

Signing algorithms: HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA.

60 features in totaljwt-auth/v1

JWT Auth Pro Installer

After purchase · Step 1 of 6

Install Pro

Download the Pro zip from your account, upload through Plugins → Add New.

Most teams have Pro running before they refill their coffee.

Guestbook — 60,000+ sites trust our authentication

8 notesReviews of the free plugin on WordPress.org

Perfect to use for API

JWT is brillant and it works out of the box. Further to this is it really stable and does it job.

Steffi

High quality plugin

Delivers what is promised. And that’s quite comprehensive list of features. Recommended.

Martin Šenkeřík

Easy, stable, powerful, extensible

Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!

MadeByCaliper

Very useful plugin

I’m using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps

softradeweb

Exactly as described, very easy to use and clear documentation. Thank you

WildPress

Great plugin!

I’ve been using the plugin for over year, it’s very good and user friendly!

Mwale Kalenga

Simply perfect!

I integrated it with my Flutter app, and it works flawlessly.

graficowalab

Perfect

Does exactly what it states! Have been using this plugin for about a year now and haven’t had any problems!

xero2112

Price List

Simple, site-based pricing — every plan is full Pro.

Billing:

Professional Single Site

1 site
$59.99per year

 

Get Single Site

Professional Team

up to 5 sites
$149.99per year

 

Get Team

Professional Agency

up to 20 sites
$339.99per year

Adds white-labeling.

Get Agency

Every plan includes

  • Token Management Dashboard
  • Token Refresh with Replay Detection
  • Instant & Auto Revocation
  • Usage Analytics (7d/30d/90d)
  • Rate Limiting & Security Headers
  • GeoIP Tracking
  • All settings via UI
  • IP Anonymization & Data Retention
  • 30+ Developer Hooks & Filters
  • Priority Support
14-day compatibility guarantee on every plan. Local and staging installs are free. One payment, no upsells inside the plugin.Requires PHP 8.1+ and WordPress 5.0+

Help — Questions & Answers

What does Pro do that the free plugin does not?

The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.

Does this plugin work out of the box?

Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.

What happens if Pro does not work on my setup?

Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).

Does a local install count as a site for my license?

No. Local and staging environments do not count against your quota.

Do you offer lifetime access?

Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.

Do you offer a free trial?

No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.

What are the system requirements?

PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.

How does token refresh work?

On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.

What happens to tokens when a user changes password, email, or role?

By default all of that user’s tokens are revoked. Each rule can be toggled independently and customized with filters.

What signing algorithms are supported?

HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.

10 topics

The free plugin generates tokens and walks away. Keep track of them?

Pro tracks every token, logs every access, and lets you revoke instantly — with a 14-day compatibility guarantee on every plan.

Compare Free vs Pro See Pro plans