Connect clients to WordPress REST APIs

JWT Authentication for WP REST APIs Premium Plan lets you choose how clients authenticate when they access default WordPress REST API endpoints, custom endpoints, and endpoints supplied by third-party add-ons. It can support mobile apps, external services, and custom integrations. Supported add-on endpoints include WooCommerce, LearnDash, BuddyPress, Gravity Forms, and CoCart.

Choose an authentication method

• JWT Authentication: Exchange visitor credentials through an authentication endpoint for a JSON Web Token, then use the token to access protected APIs. Login, refresh, and revoke token endpoints support token management.
• API Key Authentication: Use a universal API key or a user-specific key.
• Basic Authentication: Use a username and password or an email and password.
• OAuth 2.0 Authentication: Use the Password Grant or Client Credentials Grant.
• External token-based authentication: Accept supported provider tokens, including OIDC, JWT, and Firebase provider tokens.

Manage tokens and endpoint access

A client can request a new access token with a refresh token when its current token expires, reducing the need for repeated logins. Revoke controls can invalidate tokens for admin-triggered logout or session control, including when a device is lost or compromised.

Apply authentication to all REST API endpoints or select which endpoints require it. Other controls let you restrict access for non-logged-in users or disable the WordPress REST APIs, set time-based token expiry, and apply role-based REST API authentication. You can use a custom header instead of relying only on the Authorization header. The plugin can also create WordPress users from access tokens supplied by third-party providers.

Set up the connection

Install the plugin in WordPress, choose the authentication method, and configure the API protection options. Select the endpoints or endpoint groups to protect, then set token expiry and role rules where needed. Give the client the appropriate token, API key, credentials, or OAuth flow, and test the selected endpoint before connecting the production application. The plugin does not shop user data.