Extends the WP REST API using JSON Web Tokens Authentication as an authentication method.
As of April 2026, JWT Authentication for WP REST API is a WordPress jwt plugin with 60K+ active installations and a 4.4/5 rating from 53 reviews. It has been downloaded 902K+ times in total. Requires WordPress 4.2+ and PHP 7.4.0+. Available on WordPress.org since 2015. Recently updated within the last 3 months. Downloads are down 21% this week. Top alternative: JWT Auth – WordPress JSON Web Token….
This plugin seamlessly extends the WP REST API, enabling robust and secure authentication using JSON Web Tokens (JWT). It provides a straightforward way to authenticate users via the REST API, returning a standard JWT upon successful login.
/token and /token/validate endpoints for generating and validating tokens.wp-config.php for secure token signing.wp-config.php constant.jwt_auth_expire, jwt_auth_token_before_sign, etc.) for customizi…I currently have the free version, and it’s great and simple to use. I never had an issue with it.
they make it confusing and confounding on purpose
The support guy is not a non-techie, so the support was actually helpful! The plugin works great and let me really extend the user system of my WP so it can act in a auth/auth capacity for the services behind it.
Upgrade message cannot be removed from my site.
Hi, actually I am trying to generate token at my login time using an wp_login hook but i am unable to do so, can you provide me any way to do it.
Tell me whether there is any buildin function is there that I can use.
add_action(‘wp_login’, function ($user_login, $user) {
if (!user_can($user, ‘dokandar’)) {
return;
}
$response = wp_remote_post(site_url('/wp-json/jwt-auth/v1/token'), [
'body' => [
'username' => $user_login,
'password' => 'YOUR_DEFAULT_PASSWORD_IF_AVAILABLE', // Not ideal, see note below
],
]);
if (is_wp_error($response)) {
error_log('Token request failed: ' . $response->get_error_message());
return;
}
$body = json_decode(wp_remote_retrieve_body($response), true);
if (!empty($body['token'])) {
update_user_meta($user->ID, 'vendor_jwt_token_key', $body['token']);
} else {
error_log('JWT token missing: ' . json_encode($body));
}
}, 10, 2); I am using this thing but thing is password can’t be accessed directly in wordpress.
| WordPress | 4.2+ requiredTested up to 6.9.4 |
| PHP | 7.4.0+ required |
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.