JWT Auth Pro Get it now

Incipit liber clavium. Here beginneth the Book of Tokens, and of the Keeper who mindeth them.

JWT Auth Pro adds the missing control layer to the free JWT plugin you're already running: a token dashboard, refresh tokens, instant revocation, audit logs, and rate limiting, managed from wp-admin, without rebuilding your existing auth flow.

See Pro plans Compare Free vs Pro
The Keeper of the Keys, who letteth no token pass unseen.
a replay attack, slain by family tracking

Built on our free JWT plugin — trusted by 60,000+ active installs and backed by a 14-day compatibility guarantee.

Of the two charters, the lesser and the great

Both add JWT to WordPress. The difference is what happens after the token is issued: the free plugin generates tokens and walks away. Pro tracks every token, logs every access, and lets you revoke instantly.

The Lesser Charter

Free · from WordPress.org

Be it known that the bearer is granted:

Core Authentication

  • Basic JWT Authentication — add login via JSON Web Tokens
  • Token Generation — issue access tokens on successful auth
  • Token Validation — verify token integrity on each request

Withheld from this charter: Token Refresh · Instant Revocation · Token Dashboard · Auto-Revoke on Password Change · Auto-Revoke on Email/Role Change · Analytics Dashboard · GeoIP Tracking · Rate Limiting · Security Headers · Token Family Tracking · All Settings via WordPress UI · Configurable Signing Algorithms · IP Anonymization · Data Retention Policies · Priority Support · Detailed Documentation · 30+ Developer Hooks & Filters

Stay on free if you only need to generate and validate tokens for a small project.

Free forever

The Great Charter

JWT Auth Pro

Be it known that the bearer is granted all of the lesser charter, and moreover:

Core Authentication

  • Basic JWT Authentication — add login via JSON Web Tokens
  • Token Generation — issue access tokens on successful auth
  • Token Validation — verify token integrity on each request

Token Management

  • Token Refresh — secure refresh with 64-char tokens and replay attack prevention
  • Instant Revocation — revoke compromised sessions immediately
  • Token Dashboard — see every active token, owner, expiry, and last activity
  • Auto-Revoke on Password Change — all sessions killed when a password is compromised
  • Auto-Revoke on Email/Role Change — sessions invalidated on identity or permission changes

Visibility & Security

  • Analytics Dashboard — success/failure rates, response times, 7d/30d/90d history
  • GeoIP Tracking — country detection from IP via MaxMind GeoLite2
  • Rate Limiting — IP-based, 60 req/min default, configurable, HTTP 429 responses
  • Security Headers — automatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection
  • Token Family Tracking — detects refresh token replay attacks by tracking token lineage

Configuration & Compliance

  • All Settings via WordPress UI — no wp-config.php editing required
  • Configurable Signing Algorithms — HS256, RS256, ES256, EdDSA and more, from the UI
  • IP Anonymization — GDPR-compliant option to anonymize stored IP addresses
  • Data Retention Policies — configurable 1–365 day retention for analytics and token data

Support & Developer Tools

  • Priority Support — direct help from the developer
  • Detailed Documentation — guides, examples, best practices
  • 30+ Developer Hooks & Filters — actions and filters for deep integration

Upgrade to Pro if you need to inspect, refresh, revoke, audit, and rate-limit tokens in production — from the WP admin, without custom code.

Starts at $59.99/yr

Six petitions brought before the Keeper

Each is something the free plugin doesn't ship with — and something you'd otherwise build, debug, and maintain yourself.

I need refresh tokens.

The Keeper answereth. Keep users logged in without storing passwords. Secure 64-character refresh tokens with family tracking detect replay attacks automatically.

☙ Granted by Token Refresh + Replay Detection

I need to revoke any token instantly.

The Keeper answereth. Revoke any token in a single click. Stop a compromised session from hitting your API before the next request lands.

☙ Granted by Instant Revocation

I need automatic protection on credential changes.

The Keeper answereth. Tokens auto-revoke when a user changes their password, email, or role — so one leaked credential never leaves the API wide open.

☙ Granted by Auto-Revoke Rules

I need to see every token at a glance.

The Keeper answereth. Every active token in one dashboard — owner, expiry, last activity, country of origin. No more guessing which app still holds a session.

☙ Granted by Token Dashboard + GeoIP

I need API analytics and rate limiting.

The Keeper answereth. Success and failure rates, response times, 7/30/90-day windows. Built-in IP rate limiting and automatic security headers on every response.

☙ Granted by Analytics + Rate Limiting

I need a UI instead of custom code.

The Keeper answereth. Drop your secret key into wp-config.php once. Everything else — signing algorithm, token lifetime, CORS, retention policy — lives in WordPress admin instead of code.

☙ Granted by Configuration via WP Admin

Not just authentication. Complete token control.

Here followeth the register of key-holders, and the instruments of the Keeper's office — 60 features in all.

The Register of Key-holders

Token Dashboard: every active token in one view — who owns it, when it was issued, when it expires, last activity. Break a seal to revoke with one click.

Key-holderLast usedSeal
Two seals stand unbroken.

Custom Claims

A formula for the scribe, to be copied into functions.php

Add custom claims to JWT tokens using WordPress filters.

add_filter('jwt_auth_token_before_sign',
  function($token, $user) {
    $token['customer_type'] =
      get_user_meta($user->ID, 'customer_type', true);
    $token['loyalty_points'] =
      get_user_meta($user->ID, 'loyalty_points', true);
    $token['preferred_currency'] =
      get_user_meta($user->ID, 'currency', true);
    return $token;
}, 10, 2);

The Chronicle

Security Audit Trail

Complete compliance logging with full context. One entry, as the chronicle keepeth it:

Created
June 13, 2025 3:08 am
IP
110.11.194.83
User agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/124
Hash
bb414972b6df2f5a902...
User
John Doe (ID 1)
Last used
June 13, 2025 3:08 am
Revoked
June 13, 2025 3:08 am

Three Standing Edicts

Automatic Revocation Policies

Tokens auto-revoke on password change, email change, or role change. One compromised account doesn't mean open API access. Each edict may be set or lifted on its own.

The Keeper's Ledger

Admin Configuration Interface

Aside from the secret key in wp-config.php, every setting is kept in WordPress admin.

  • JWT token expiration7 days
  • Refresh token expiration30 days
  • Analytics retention90 days

The Watch at the Gate

Rate Limiting & Security Headers

IP-based rate limiting at 60 requests per minute (configurable), answered with HTTP 429 when exceeded. Security headers are set automatically on every response. No nginx config required.

HSTSX-Frame-OptionsX-Content-Type-OptionsXSS-Protection

The Reckoning

Usage Analytics

Authentication events, success and failure rates, response times, and geographic distribution — reckoned over 7-day, 30-day, and 90-day windows.

Signing algorithms, chosen from the settings UI

HS256/384/512RS256/384/512ES256/384/512PS256/384/512EdDSA

Three Offices, Any Client

Works with React, Vue, Flutter, mobile apps, or any client.

Generate Token

POST /wp-json/jwt-auth/v1/token

Authenticate users and issue tokens with a single API call.

Validate Token

/wp-json/jwt-auth/v1/token/validate

Signature check, claims validation, expiration status.

Refresh Token

/wp-json/jwt-auth/v1/token/refresh

Auto renewal, lifecycle management, session continuity.

The rite of installation, in six parts

What happeneth after purchase, in the order it happeneth.

  1. Install Pro

    Download the Pro zip from your account, upload through Plugins → Add New.

  2. Activate your license

    Paste the key once. Local and staging installs don't count against the quota.

  3. Configure JWT

    Drop your secret key into wp-config.php once; pick signing algorithm, token lifetime, CORS, retention from the admin UI.

  4. Enable Pro features

    Refresh tokens, auto-revoke rules, analytics, rate limiting. Each is a single checkbox.

  5. Verify in the token dashboard

    Hit your API; watch tokens appear live with owner, expiry, IP, country.

  6. 14-day compatibility safety net

    Support reaches the plugin author directly. If Pro can't be made to work on your stack, you get a refund.

Most teams have Pro running before they refill their coffee.

Perfect to use for APIJWT is brillant and it works out of the box. Further to this is it really stable and does it job.Steffi
High quality pluginDelivers what is promised. And that's quite comprehensive list of features. Recommended.Martin Šenkeřík
Easy, stable, powerful, extensibleAllowed me to get up and running with a Vue.js frontend authentication flow within minutes. Really great documentation too!MadeByCaliper
Very useful pluginI'm using this plugin since some months and it works perfectly, a simple way to authenticate from ext. appssoftradeweb

60,000+ sites trust our authentication

Glosses set in the margins by the scribes of WordPress.org, in their own words.

Exactly as described, very easy to use and clear documentation. Thank youWildPress
Great plugin!I've been using the plugin for over year, it's very good and user friendly!Mwale Kalenga
Simply perfect!I integrated it with my Flutter app, and it works flawlessly.graficowalab
PerfectDoes exactly what it states! Have been using this plugin for about a year now and haven't had any problems!xero2112

Three charters, each sealed and whole

Simple, site-based pricing — every plan is full Pro.

Professional Single Site

For 1 site

$59.99each year

A lifetime option is also offered.

Get it now

Professional Team

For up to 5 sites

$149.99each year

A lifetime option is also offered.

Get it now

Professional Agency

For up to 20 sites

$339.99each year

Adds white-labeling. A lifetime option is also offered.

Get it now

Every charter granteth the whole of Pro

  • Token Management Dashboard
  • Token Refresh with Replay Detection
  • Instant & Auto Revocation
  • Usage Analytics (7d/30d/90d)
  • Rate Limiting & Security Headers
  • GeoIP Tracking
  • All settings via UI
  • IP Anonymization & Data Retention
  • 30+ Developer Hooks & Filters
  • Priority Support

And these covenants

  • 14-day compatibility guarantee on every plan
  • Local and staging installs are free
  • One payment, no upsells inside the plugin
  • Requires PHP 8.1+ and WordPress 5.0+

A catechism for the cautious

Questions oft asked, and their plain answers.

What does Pro do that the free plugin does not?

The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: token dashboard, refresh tokens with replay-attack detection, instant and automatic revocation, analytics over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, GDPR-friendly data retention. Aside from the secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.

Does this plugin work out of the box?

Yes. Pro adds a professional JWT layer on top of the WP REST API: create, validate, refresh, revoke tokens so users can authenticate from mobile apps, SPAs, or any external system. You still implement the calling logic in those clients.

What happens if Pro does not work on my setup?

Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack, you get a refund (processor fees, typically 3–5%, are deducted).

Does a local install count as a site for my license?

No. Local and staging environments do not count against your quota.

Do you offer lifetime access?

Yes. Every plan has a yearly and a lifetime option; lifetime is a one-time payment.

Do you offer a free trial?

No traditional trial, but the 14-day compatibility guarantee covers the only risk that matters: whether Pro runs on your stack.

What are the system requirements?

PHP 8.1+, WordPress 5.0+ with the REST API enabled, HTTP Authorization header enabled on the server.

How does token refresh work?

On login the client gets an access token (default 7 days) and a refresh token (default 30 days). When the access token expires the client exchanges the refresh token for a new one without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.

What happens to tokens when a user changes password, email, or role?

By default all of that user's tokens are revoked. Each rule can be toggled independently and customized with filters.

What signing algorithms are supported?

HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, EdDSA; chosen in the settings UI or via the jwt_auth_algorithm filter.

Here endeth the book. Take up the keys.

You already run the free plugin. Pro adds the dashboard, refresh tokens, instant revocation, audit logs, and rate limiting — managed from wp-admin, without rebuilding your existing auth flow.

See Pro plans Compare Free vs Pro