Get it now

Production-grade JWT Auth for WordPress developers.

JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.

See Pro plans Compare Free vs Pro
JWT Auth Pro — token network mapSelect any station for details · Schematic, not to scale

Swipe the map sideways to follow the lines

Built on our free JWT plugin — trusted by 60,000+ active installs Backed by a 14-day compatibility guarantee

Upgrade Line Compare Junction

Both add JWT to WordPress. The difference is what happens after the token is issued.

The free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly. Here are the two networks, drawn to the same key.

Free network (WP.org)

1 line · 3 stops Free forever

Core Authentication Line

  1. Basic JWT AuthenticationAdd login via JSON Web Tokens
  2. Token GenerationIssue access tokens on successful auth
  3. Token ValidationVerify token integrity on each request
  4. Service terminates here. No onward connections to refresh, revocation, the dashboard, analytics or rate limiting.

Pro network

5 lines · 20 stops starts at $59.99/yr

Core Authentication Line same three stops as Free

  1. Basic JWT AuthenticationAdd login via JSON Web Tokens
  2. Token GenerationIssue access tokens on successful auth
  3. Token ValidationVerify token integrity on each request

Token Management Line Pro only

  1. Token RefreshSecure refresh with 64-char tokens and replay attack prevention
  2. Instant RevocationRevoke compromised sessions immediately
  3. Token DashboardSee every active token, owner, expiry, and last activity
  4. Auto-Revoke on Password ChangeAll sessions killed when a password is compromised
  5. Auto-Revoke on Email/Role ChangeSessions invalidated on identity or permission changes

Visibility & Security Line Pro only

  1. Analytics DashboardSuccess/failure rates, response times, 7d/30d/90d history
  2. GeoIP TrackingCountry detection from IP via MaxMind GeoLite2
  3. Rate LimitingIP-based, 60 req/min default, configurable, HTTP 429 responses
  4. Security HeadersAutomatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection
  5. Token Family TrackingDetects refresh token replay attacks by tracking token lineage

Configuration & Compliance Line Pro only

  1. All Settings via WordPress UINo wp-config.php editing required
  2. Configurable Signing AlgorithmsHS256, RS256, ES256, EdDSA and more, from the UI
  3. IP AnonymizationGDPR-compliant option to anonymize stored IP addresses
  4. Data Retention PoliciesConfigurable 1–365 day retention for analytics and token data

Support & Developer Tools Line Pro only

  1. Priority SupportDirect help from the developer
  2. Detailed DocumentationGuides, examples, best practices
  3. 30+ Developer Hooks & FiltersActions and filters for deep integration

Stay on Free if you only need to generate and validate tokens for a small project.

Upgrade to Pro if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code.

Upgrade Line Six Ways

Six reasons developers change from Free to Pro.

Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself.

Refresh Loop

"I need refresh tokens."

Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.

Change here forToken Refresh + Replay Detection
Login Line

"I need to revoke any token instantly."

Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.

Change here forInstant Revocation
Login Line

"I need automatic protection on credential changes."

Tokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.

Change here forAuto-Revoke Rules
Audit Line

"I need to see every token at a glance."

Every active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.

Change here forToken Dashboard + GeoIP
Audit Line

"I need API analytics and rate limiting."

Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.

Change here forAnalytics + Rate Limiting
Validate Express

"I need a UI instead of custom code."

Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.

Change here forConfiguration via WP Admin

Upgrade Line Control Room

Not just authentication. Complete token control.

What the signal box at Dashboard Central actually looks like — 60 features in all, every one of them run from wp-admin.

Token Dashboard

Every active token in one view: who owns it, when it was issued, when it expires, last activity. Revoke with one click — try it.

Token ownerLast usedService
2 tokens in service.

Custom Claims

Add custom claims to JWT tokens using WordPress filters.

functions.php 
add_filter('jwt_auth_token_before_sign', function($token, $user) {
    $token['customer_type'] =
        get_user_meta($user->ID, 'customer_type', true);
    $token['loyalty_points'] =
        get_user_meta($user->ID, 'loyalty_points', true);
    $token['preferred_currency'] =
        get_user_meta($user->ID, 'currency', true);
    return $token;
}, 10, 2);

Automatic Revocation Policies

One compromised account doesn't mean open API access. Each rule toggles independently.

Security Audit Trail

Complete compliance logging with full context.

Created
June 13, 2025 3:08 am
IP
110.11.194.83
User agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
Hash
bb414972b6df2f5a902...
User
John Doe (ID 1)
Last used
June 13, 2025 3:08 am
Revoked
June 13, 2025 3:08 am

Rate Limiting & Security Headers

60requests per minute, per IP
(configurable)

Over the limit, clients get HTTP 429. Every response carries the headers below. No nginx config required.

HSTSX-Frame-OptionsX-Content-Type-OptionsXSS-Protection

Admin Configuration Interface

Drop the secret key into wp-config.php once. Everything else is a setting.

JWT token expiration7 days
Refresh token expiration30 days
Analytics retention90 days

Three endpoints, any client

Works with React, Vue, Flutter, mobile apps, or any client.

POST /wp-json/jwt-auth/v1/tokenGenerate TokenAuthenticate users and issue tokens with a single API call.
/token/validateValidate TokenSignature check, claims validation, expiration status.
/token/refreshRefresh TokenAuto renewal, lifecycle management, session continuity.
HS256/384/512RS256/384/512ES256/384/512PS256/384/512EdDSA

Upgrade Line After purchase

Six stops from checkout to production.

  1. Install Pro

    Download the Pro zip from your account, upload through Plugins → Add New.

  2. Activate your license

    Paste the key once. Local and staging installs don't count against the quota.

  3. Configure JWT

    Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.

  4. Enable Pro features

    Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.

  5. Verify in the token dashboard

    Hit your API; watch tokens appear live with owner, expiry, IP, country.

  6. 14-day compatibility safety net

    Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.

Upgrade Line Platform posters

60,000+ sites trust our authentication.

Pasted up along the platform: real reviews of the free plugin from WordPress.org.

Easy, stable, powerful, extensible

Allowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!

MadeByCaliperWordPress.org review

Perfect to use for API

JWT is brillant and it works out of the box. Further to this is it really stable and does it job.

SteffiWordPress.org review

High quality plugin

Delivers what is promised. And that's quite comprehensive list of features. Recommended.

Martin ŠenkeříkWordPress.org review

Simply perfect!

I integrated it with my Flutter app, and it works flawlessly.

graficowalabWordPress.org review

Very useful plugin

I'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. apps

softradewebWordPress.org review

Great plugin!

I've been using the plugin for over year, it's very good and user friendly!

Mwale KalengaWordPress.org review

Perfect

Does exactly what it states! Have been using this plugin for about a year now and haven't had any problems!

xero2112WordPress.org review

Exactly as described, very easy to use and clear documentation. Thank you

WildPressWordPress.org review

Upgrade Line Ticket hall

Simple, site-based fares. Every ticket is full Pro.

One zone per site. Pick how many you travel through; the network is the same on every ticket.

Zone1
JWT-PRO
SINGLE · ADULT

Professional Single Site

Valid on 1 site

$59.99 / year

Lifetime option available.

Get it now
Zones1–5
JWT-PRO
TEAM · GROUP

Professional Team

Valid on up to 5 sites

$149.99 / year

Lifetime option available.

Get it now
Zones1–20
JWT-PRO
AGENCY · WHITE-LABEL

Professional Agency

Valid on up to 20 sites · adds white-labeling

$339.99 / year

Lifetime option available.

Get it now

Every ticket is valid on all lines

  • Token Management Dashboard
  • Token Refresh with Replay Detection
  • Instant & Auto Revocation
  • Usage Analytics (7d/30d/90d)
  • Rate Limiting & Security Headers
  • GeoIP Tracking
  • All settings via UI
  • IP Anonymization & Data Retention
  • 30+ Developer Hooks & Filters
  • Priority Support

Conditions of carriage

  • 14-day compatibility guarantee on every plan
  • Local and staging installs are free
  • One payment, no upsells inside the plugin
  • Requires PHP 8.1+ and WordPress 5.0+

Upgrade Line Help point

Service information.

Questions passengers ask All lines · good service
What does Pro do that the free plugin does not?

The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.

Does this plugin work out of the box?

Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.

What happens if Pro does not work on my setup?

Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).

Does a local install count as a site for my license?

No. Local and staging environments do not count against your quota.

Do you offer lifetime access?

Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.

Do you offer a free trial?

No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.

What are the system requirements?

PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.

How does token refresh work?

On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.

What happens to tokens when a user changes password, email, or role?

By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.

What signing algorithms are supported?

HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.

Upgrade Line Terminus

All change, please. This line terminates at Pro.

You already run the free plugin. Add the dashboard, refresh tokens, instant revocation, audit logs and rate limiting — and keep your existing auth flow exactly where it is.

See Pro plansCompare Free vs Pro