Authentication for WordPress REST APIs
JWT Authentication for WP REST APIs Premium Plan helps control access to WordPress REST API endpoints through several authentication methods. It can authenticate default WordPress endpoints, custom-developed REST endpoints, and endpoints provided by third-party plugins. This makes the plan suitable for mobile applications, external services, custom integrations, and WordPress sites that need authenticated API access.
The plugin supports JWT Authentication, Basic Authentication, API Key Authentication, OAuth 2.0 Authentication, and external token-based authentication. Supported external provider approaches include OIDC, JWT, and Firebase provider tokens. Authentication can be applied to WooCommerce, LearnDash, BuddyPress, Gravity Forms, CoCart, and other third-party plugin API endpoints.
Token and credential methods
JWT Authentication provides an endpoint where user credentials can be exchanged for a JSON Web Token. Clients can then use that token when accessing protected WordPress REST APIs. The Premium Plan also includes login, refresh, and revoke token endpoints for token management.
Refresh tokens allow a client to request a new access token when the current token expires, helping reduce repeated logins. Revoke token controls can be used to invalidate tokens, support admin-triggered logout or session control, and respond when a device is lost or compromised.
- API Key Authentication: Use universal API keys or user-specific API keys.
- Basic Authentication: Authenticate with username and password or email and password.
- OAuth 2.0: Use Password Grant or Client Credentials Grant.
- External provider authentication: Accept supported third-party access tokens, including JWT tokens.
Endpoint and access controls
The Premium Plan can authenticate all REST API endpoints, including core WordPress, custom, and third-party plugin endpoints. Selective API protection lets you choose which endpoints require authentication. You can restrict non-logged-in users from accessing REST API endpoints or disable the WordPress REST APIs.
Additional controls include time-based token expiry, role-based WordPress REST API authentication, and support for a custom header instead of only the Authorization header. The plugin can also create WordPress users based on access tokens supplied by third-party providers.
Practical integration uses
Use the plan when an external application needs authenticated access to WordPress data, when a custom REST API needs a credential-based access layer, or when a third-party plugin’s endpoints must be included in an API authentication workflow. The available token controls are also useful for applications that need refreshed sessions or token revocation.
Installation and setup
Install the plugin in WordPress, select the authentication method required by the application, and configure the relevant API protection settings. Choose the endpoints or endpoint groups to protect, set token expiry and role rules where needed, and provide the client with the appropriate token, API key, credentials, or OAuth flow. Test the selected endpoint with the chosen authentication method before connecting the production application.
The plugin does not store user data.
