JWT Authentication PRO: Configure REST API Tokens in WordPress

Advanced JWT authentication for the WordPress REST API

JWT Authentication PRO extends the WordPress REST API with additional utilities for applications that need more than basic token creation and validation. It builds on JSON Web Tokens, an open industry standard for representing claims between two parties, and provides a practical authentication layer for REST-based WordPress projects.

The PRO edition is suited to developers connecting external applications, mobile interfaces, JavaScript clients, or other services to WordPress. After a successful login, the authentication workflow can use a token for later API requests, while the available PRO features provide more control over how those tokens are signed and managed.

Capabilities for more controlled token processes

• Multiple signing algorithms: Choose from additional algorithms including RS256 and ES256 for projects that require alternatives to the standard signing approach.
• Token refresh: Use additional functionality for refreshing tokens as part of a continuing authentication workflow.
• Token revocation: Add the ability to revoke tokens when an application or visitor session should no longer remain active.
• Admin-based configuration: Manage settings through a simple WordPress admin UI instead of relying only on configuration constants in wp-config.php.
• Enhanced error tracking and monitoring: Gain more visibility into authentication errors and token-related activity.
• Priority support: The PRO edition is presented as the upgrade option for priority support.

Designed around REST API endpoints

The underlying plugin adds the jwt-auth/v1 namespace and provides token and token-validation endpoints. The token endpoint accepts user credentials and returns a JWT when authentication succeeds. The validation endpoint checks a token supplied through the Authorization header. JWT Authentication PRO adds further endpoints for token refresh and revocation, extending the basic request cycle for applications with longer-running or more controlled sessions.

This structure can support a range of practical workflows. A frontend application can authenticate against WordPress, retain the returned token, and send it with later REST API requests. A service that needs to end access can use revocation, while an application that needs to continue a session can use token refresh. Developers can also use the expanded signing choices to align the authentication setup with their project requirements.

Requirements and configuration

The add-on is built on the WordPress REST API V2 and requires that the WP REST API plugin be installed and activated. The stated minimum PHP version is 7.4.0. Hosting environments may also require the HTTP Authorization Header to be enabled. The source documentation includes Apache and WPEngine configuration examples for passing this header through.

JWT authentication requires a unique secret key for signing tokens. With the PRO edition, settings can be managed through the WordPress admin UI. CORS support can also be enabled through the documented wp-config.php constant when cross-origin requests are part of the project.

Installation and first steps

1. Install and activate the WP REST API plugin.
2. Install and activate JWT Authentication PRO.
3. Open the available settings area and configure the authentication settings.
4. Confirm that the HTTP Authorization Header is available on the hosting environment.
5. Test token creation, validation, refresh, and revocation with the REST API endpoints used by the application.

Developers can also use the plugin’s REST API authentication workflow and available hooks when connecting WordPress to custom applications.