Production-grade JWT Auth for WordPress developers.

The free plugin issues and validates JWT tokens — that is it. Pro adds the production layer most teams build by hand: a token dashboard (every active token with owner, expiry, last activity, and country), refresh tokens with replay-attack detection, instant and automatic revocation, an analytics dashboard with success/failure rates over 7/30/90 days, IP-based rate limiting, automatic security headers, configurable signing algorithms, and GDPR-friendly data retention. Aside from the JWT secret key in wp-config.php, every Pro setting is managed from the WordPress admin UI.

Yes. When you install JWT Authentication Pro, a professional JWT authentication layer is added on top of the WordPress REST API. You can create, validate, refresh, and revoke JWT tokens for your WordPress users so they can authenticate from mobile apps, SPAs, or any external system. You will still need to implement the calling logic in those clients — Pro provides the authentication infrastructure and management layer; the client-side request code is up to you.

Every plan includes a 14-day compatibility guarantee. Open a support ticket and we work the issue with you directly. If Pro genuinely cannot run on your stack and we cannot resolve it, you get a refund (payment processor fees, typically 3–5%, are deducted). You must work with support first before requesting the refund — most "incompatibility" reports turn out to be solvable in a single email exchange.

No. Local and staging environments do not count against your license quota. Develop and test Pro on as many local and staging installs as you need. The license activates only when you deploy to a production server.

Yes. Every plan has both a yearly and a lifetime option. Lifetime is a one-time payment for unlimited future use of the version line you purchase, including all updates and support during the support window. Pricing is shown above — toggle between yearly and lifetime on the pricing cards.

No traditional free trial — but the 14-day compatibility guarantee functions as one for the only risk that matters: whether Pro runs on your specific stack. Install, configure, exercise it against your API. If it cannot be made to work and our support team confirms it, you get a refund.

JWT Authentication Pro requires PHP 8.1 or higher and WordPress 5.0 or higher with the REST API enabled. You will need to add your JWT secret key to wp-config.php once during setup — all other configuration (signing algorithm, token lifetime, CORS, retention policies, etc.) is managed through the WordPress admin UI. Your server needs the HTTP Authorization header enabled.

When a user authenticates, they receive an access token and a refresh token. The access token expires after a configurable period (default 7 days) and is used for API requests. When it expires, the client uses the refresh token (valid for 30 days by default) to obtain a new access token without re-prompting the user. Refresh tokens are 64 characters, tracked as a family, and detect replay attacks automatically.

By default, all tokens for that user are automatically revoked on password, email, or role change. This protects you from leaked credentials remaining valid after a reset. Each auto-revoke rule can be toggled on or off independently, and you can customize behavior further using filters.

Yes. JWT Authentication Pro ships with an analytics dashboard that tracks authentication attempts, success and failure rates, response times, active users, and geographic distribution (via MaxMind GeoLite2). You can scope the view to the last 7, 30, or 90 days and configure how long raw data is retained.

The plugin supports HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512, and EdDSA. You can choose your algorithm through the settings UI or via the jwt_auth_algorithm filter.

Use the jwt_auth_token_before_sign and jwt_auth_token_before_dispatch filters to modify token claims and response payloads. Pro also provides an admin interface for configuring custom validation rules, token lifetime, and security policies — so most adjustments do not require code.

CORS support is enabled in the plugin settings. The plugin provides filters to customize CORS headers and origins to match your application’s needs.

No, JWT Authentication Pro is not an SSO solution. It does not integrate with external identity providers like Google, Microsoft, or SAML systems. It is specifically designed to add token-based authentication to the WordPress REST API for external applications, not for cross-platform single sign-on.

No, JWT Authentication Pro does not replace WordPress's built-in user authentication system. It does not handle user registration, password resets, or traditional WordPress login pages. It adds token-based authentication specifically for API access while keeping all existing WordPress functionality intact.

No. JWT Authentication Pro is not designed for managing regular WordPress website sessions or cookie-based authentication. It is specifically built for stateless, token-based API authentication used by external applications like mobile apps, SPAs, or headless WordPress setups.

No, JWT Authentication Pro is not a general security plugin like Wordfence or Sucuri. It does not protect against malware, secure login pages, or provide general website security features. Its security features are specifically designed for protecting API endpoints and managing token-based authentication.

JWT Authentication Pro is developed by Enrique Chavez (@tmeister), a full-stack developer focused on WordPress and open-source technologies. Enrique has contributed to the WordPress ecosystem for years, creating plugins and tools that help developers build more efficiently. JWT Authentication Pro is designed to be simple, flexible, and developer-friendly.