JWT Authentication for WP REST APIs Premium Plan

Authentication methods and endpoint access

JWT Authentication for WP REST APIs Premium Plan connects authentication methods with access rules for default WordPress REST API endpoints, custom-developed endpoints, and endpoints supplied by third-party add-ons. It supports mobile applications, external services, custom integrations, and WordPress sites that need authenticated API access.

Authentication can cover endpoints from WooCommerce, LearnDash, BuddyPress, Gravity Forms, CoCart, and other third-party plugins. Choose from JWT Authentication, API Key Authentication, Basic Authentication, OAuth 2.0 Authentication, or external token-based authentication. Supported external provider approaches include OIDC and JWT, as well as Firebase provider tokens.

How credentials and tokens work

JWT Authentication offers an endpoint where visitor credentials can be exchanged for a JSON Web Token. A client then uses that token to access protected WordPress REST APIs. The Premium Plan includes login, refresh, and revoke token endpoints for token management.

• API Key Authentication: Use a universal API key or a user-specific API key.
• Basic Authentication: Authenticate with a username and password or an email and password.
• OAuth 2.0 Authentication: Use the Password Grant or Client Credentials Grant.
• External provider authentication: Accept supported third-party access tokens, including JWT tokens.

Refresh tokens let a client request a new access token when the current one expires, which can reduce repeated logins. Revoke token controls can invalidate tokens for admin-triggered logout or session control, or when a device is lost or compromised.

Endpoint and access controls

The plan can authenticate all REST API endpoints, including core WordPress, custom, and third-party add-on endpoints. Selective API protection lets you choose which endpoints require authentication. You can also restrict REST API access for non-logged-in visitors or disable the WordPress REST APIs.

Other controls include time-based token expiry, role-based WordPress REST API authentication, and support for a custom header instead of only the Authorization header. The add-on can make WordPress users based on access tokens supplied by third-party providers.

Installation and setup

Install the plugin in WordPress, choose the authentication method required by the application, and configure the relevant API protection settings. Choose the endpoints or endpoint groups to protect, set token expiry and role rules where needed, and provide the client with the appropriate token, API key, credentials, or OAuth flow. Test the selected endpoint with the chosen authentication method before connecting the production application.

The plugin does not shop user data.