Version 2.0.0 is a major release requiring PHP 8.2+ and WordPress 7.0+. It introduces refresh-token rotation and revocation and now enforces the Enable JWT setting. Existing installs with configured signing keys are automatically kept enabled.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3667229,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3667229,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3667229,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.jpg":{"filename":"banner-1544x500.jpg","revision":3667229,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.jpg":{"filename":"banner-772x250.jpg","revision":3667229,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1","1.0.2","2.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Simple JWT Auth Settings","2":"Simple JWT Auth Options","3":"Simple JWT Auth Documentation"}},"plugin_section":[],"plugin_tags":[38851,245165,2061,23853,2300],"plugin_category":[38],"plugin_contributors":[233896],"plugin_business_model":[],"class_list":["post-207856","plugin","type-plugin","status-publish","hentry","plugin_tags-jwt","plugin_tags-jwt-authentication","plugin_tags-oauth","plugin_tags-rest-api","plugin_tags-wp-api","plugin_category-authentication","plugin_contributors-sayandey18","plugin_committers-sayandey18"],"banners":{"banner":"https:\/\/ps.w.org\/simple-jwt-auth\/assets\/banner-772x250.jpg?rev=3667229","banner_2x":"https:\/\/ps.w.org\/simple-jwt-auth\/assets\/banner-1544x500.jpg?rev=3667229","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/simple-jwt-auth\/assets\/icon.svg?rev=3667229","icon":"https:\/\/ps.w.org\/simple-jwt-auth\/assets\/icon.svg?rev=3667229","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"\n
Simple JWT Auth \u2013 JWT Authentication for WordPress REST API secures and protects your WordPress REST API using JSON Web Tokens. It lets external applications authenticate WordPress users, obtain an access token and a refresh token, and call any REST endpoint with a standard Bearer header.<\/p>\n\n
JSON Web Token (JWT) is an open standard (RFC 7519<\/a>) that defines a compact, self-contained way to transmit information securely between two parties. This plugin uses JWT to provide a modern, stateless authentication layer for headless WordPress builds.<\/p>\n\n Modern access-token and refresh-token architecture<\/strong><\/p>\n\n Secure by design<\/strong><\/p>\n\n Modern and flexible<\/strong><\/p>\n\n Built for developers<\/strong> \u2014 authenticate WordPress from React, Next.js, Vue, mobile apps, and any other external client. Configuration can live in the plugin settings or be overridden with HTTP Authorization is the mechanism clients use to send credentials to a server \u2014 a special Add the following to your Add the following to your Simple JWT Auth uses a Key-Encryption-Key (KEK)<\/strong> to encrypt and decrypt the JWT signing keys ( Rotating the KEK invalidates the stored signing keys and requires re-entering them in the plugin settings (a Instead of storing signing keys in the database, define them directly in When a constant is defined, the matching field on the Settings page is disabled and marked \"Defined in wp-config.php\".<\/p>\n\n For a fresh install, authentication is disabled by default. Turn on Enable JWT<\/strong> in the plugin settings, choose an algorithm, and provide the required signing key(s) before issuing tokens.<\/p>\n\n The plugin registers the Submit a Success response:<\/p>\n\n Store the access token and refresh token in your application (a secure cookie, For example, creating a post with an access token:<\/p>\n\n Access tokens are short-lived. When one expires, send the refresh token to The response has the same shape as the token response. Each rotation invalidates the previous refresh token.<\/p>\n\n To invalidate a session, send the refresh token to Success response:<\/p>\n\n Verify an access token with a Success response:<\/p>\n\n Get the authenticated user's profile:<\/p>\n\n Success response:<\/p>\n\n Every error returns a consistent envelope with a stable Simple JWT Auth is developer-friendly and exposes filter and action hooks to override its default behaviour.<\/p>\n\n Modify the CORS Change the token Change the token Change the token Modify the JWT payload before it is signed. The payload contains the Modify the token response before it is returned to the client. The response includes the access token, refresh token, and their lifetimes.<\/p>\n\n Fired when refresh-token reuse is detected and a token family is revoked. Arguments: Change the maximum number of attempts allowed within the rate-limit window. Default: Change the rate-limit window, in seconds. Default: A ready-to-use Postman collection is bundled with the plugin. Open Simple JWT Auth \u2192 Documentation<\/strong> in your WordPress admin and click Download Postman Collection<\/strong>, then import the JSON into Postman. The collection preconfigures your site URL and includes the token, refresh, revoke, validate, and Simple JWT Auth is open source. Visit the GitHub repository<\/a> and consider giving it a star.<\/p><\/dd>\n Thank you \u2014 contributions are welcome. See the GitHub repository<\/a> for details.<\/p><\/dd>\n Submit a ticket in the WordPress support forum<\/a> or, for developers, create a GitHub issue<\/a>.<\/p><\/dd>\n\n
simplejwt_auth_token_reuse_detected<\/code> action.<\/li>\n\/me<\/code> endpoint returns the authenticated user's profile.<\/li>\n<\/ul>\n\n\n
secret_key<\/code>, private_key<\/code>, public_key<\/code>) are encrypted at rest with AES-256-GCM using a key-encryption-key (KEK) defined in wp-config.php<\/code>.<\/li>\n\n
wp-config.php<\/code> constants.<\/p>\n\n\n
Enable PHP HTTP Authorization Header<\/h3>\n\n
Authorization<\/code> header in the HTTP request. Many shared hosts have it disabled by default.<\/p>\n\nShared hosts<\/h4>\n\n
.htaccess<\/code> file:<\/p>\n\nRewriteEngine on\nRewriteCond %{HTTP:Authorization} ^(.*)\nRewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]\n<\/code><\/pre>\n\nWP Engine<\/h4>\n\n
.htaccess<\/code> file:<\/p>\n\nSetEnvIf Authorization \"(.*)\" HTTP_AUTHORIZATION=$1\n<\/code><\/pre>\n\nConfiguration<\/h3>\n\n
secret_key<\/code>, private_key<\/code>, and public_key<\/code>) at rest. Define it in wp-config.php<\/code> with the SIMPLE_JWT_AUTH_ENCRYPT_KEY<\/code> constant. The KEK must be exactly 32 characters long and must never be revealed.<\/p>\n\ndefine( 'SIMPLE_JWT_AUTH_ENCRYPT_KEY', 'your-32-char-encryption-key' );\n<\/code><\/pre>\n\nsimplejwt_kek_mismatch<\/code> error is returned until then).<\/p>\n\nSigning keys via wp-config.php constants<\/h4>\n\n
wp-config.php<\/code> file. Constants take precedence over the plugin settings, and their values are used as-is (plaintext, not encrypted).<\/p>\n\ndefine( 'SIMPLE_JWT_AUTH_ALGORITHM', 'HS256' ); \/\/ HS256, HS384, HS512, RS256, RS384, RS512, ES256 or ES384.\ndefine( 'SIMPLE_JWT_AUTH_SECRET_KEY', 'your-secret-key' ); \/\/ Required for HS* algorithms (min 32 chars).\ndefine( 'SIMPLE_JWT_AUTH_PRIVATE_KEY', '-----BEGIN PRIVATE KEY-----...' ); \/\/ Required for RS*\/ES* signing.\ndefine( 'SIMPLE_JWT_AUTH_PUBLIC_KEY', '-----BEGIN PUBLIC KEY-----...' ); \/\/ Required for RS*\/ES* verification.\n<\/code><\/pre>\n\n\n
SIMPLE_JWT_AUTH_ALGORITHM<\/code> \u2014 overrides algorithm<\/code>, the JWT signing algorithm.<\/li>\nSIMPLE_JWT_AUTH_SECRET_KEY<\/code> \u2014 overrides secret_key<\/code>, used for symmetric (HS256\/384\/512) signing and verification.<\/li>\nSIMPLE_JWT_AUTH_PRIVATE_KEY<\/code> \u2014 overrides private_key<\/code>, used for asymmetric (RSA\/EC) signing.<\/li>\nSIMPLE_JWT_AUTH_PUBLIC_KEY<\/code> \u2014 overrides public_key<\/code>, used for asymmetric (RSA\/EC) verification.<\/li>\n<\/ul>\n\nEnabling authentication<\/h4>\n\n
REST Endpoints<\/h3>\n\n
auth\/v1<\/code> namespace with five endpoints:<\/p>\n\n\n
POST \/wp-json\/auth\/v1\/token<\/code> \u2014 Authenticate credentials; return an access token and a refresh token.<\/li>\nPOST \/wp-json\/auth\/v1\/token\/refresh<\/code> \u2014 Rotate an access token (and refresh token) using a refresh token.<\/li>\nPOST \/wp-json\/auth\/v1\/token\/revoke<\/code> \u2014 Revoke a refresh token and its rotation family.<\/li>\nPOST \/wp-json\/auth\/v1\/token\/validate<\/code> \u2014 Validate an access token.<\/li>\nGET \/wp-json\/auth\/v1\/me<\/code> \u2014 Return the authenticated user's profile.<\/li>\n<\/ul>\n\nGenerate a token<\/h4>\n\n
POST<\/code> request with username<\/code> and password<\/code>:<\/p>\n\ncurl --location 'https:\/\/example.com\/wp-json\/auth\/v1\/token' \\\n--header 'Content-Type: application\/json' \\\n--data-raw '{\n \"username\": \"wordpress_username\",\n \"password\": \"wordpress_password\"\n}'\n<\/code><\/pre>\n\n{\n \"code\": \"simplejwt_auth_credential\",\n \"message\": \"Token created successfully\",\n \"data\": {\n \"status\": 200,\n \"id\": \"2\",\n \"email\": \"user@example.com\",\n \"nicename\": \"username\",\n \"display_name\": \"User Name\",\n \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOi...\",\n \"token_expires_in\": 900,\n \"refresh_token\": \"opaque-refresh-token\",\n \"refresh_expires_in\": 1209600\n }\n}\n<\/code><\/pre>\n\nlocalStorage<\/code>, or a wrapper such as localForage<\/a>). Then pass the access token as a Bearer header on every protected request:<\/p>\n\nAuthorization: Bearer your-access-token\n<\/code><\/pre>\n\ncurl --location 'https:\/\/example.com\/wp-json\/wp\/v2\/posts' \\\n--header 'Content-Type: application\/json' \\\n--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOi...' \\\n--data '{\n \"title\": \"Hello headless\",\n \"content\": \"Created through the REST API with JWT authentication.\",\n \"status\": \"publish\"\n}'\n<\/code><\/pre>\n\nRefresh a token<\/h4>\n\n
\/token\/refresh<\/code> (in the body or as a Bearer header) to rotate it and receive a new access token and refresh token:<\/p>\n\ncurl --location 'https:\/\/example.com\/wp-json\/auth\/v1\/token\/refresh' \\\n--header 'Content-Type: application\/json' \\\n--data-raw '{ \"refresh_token\": \"opaque-refresh-token\" }'\n<\/code><\/pre>\n\nRevoke a token<\/h4>\n\n
\/token\/revoke<\/code>:<\/p>\n\ncurl --location 'https:\/\/example.com\/wp-json\/auth\/v1\/token\/revoke' \\\n--header 'Content-Type: application\/json' \\\n--data-raw '{ \"refresh_token\": \"opaque-refresh-token\" }'\n<\/code><\/pre>\n\n{\n \"code\": \"simplejwt_token_revoked\",\n \"message\": \"Token has been revoked\",\n \"data\": { \"status\": 200 }\n}\n<\/code><\/pre>\n\nValidate a token<\/h4>\n\n
POST<\/code> request carrying the Bearer header:<\/p>\n\ncurl --location --request POST 'https:\/\/example.com\/wp-json\/auth\/v1\/token\/validate' \\\n--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOi...'\n<\/code><\/pre>\n\n{\n \"code\": \"simplejwt_valid_token\",\n \"message\": \"Token is valid\",\n \"data\": { \"status\": 200 }\n}\n<\/code><\/pre>\n\nCurrent user<\/h4>\n\n
curl --location 'https:\/\/example.com\/wp-json\/auth\/v1\/me' \\\n--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOi...'\n<\/code><\/pre>\n\n{\n \"code\": \"simplejwt_user\",\n \"message\": \"User data retrieved successfully\",\n \"data\": {\n \"status\": 200,\n \"id\": 2,\n \"email\": \"user@example.com\",\n \"nicename\": \"username\",\n \"display_name\": \"User Name\",\n \"roles\": [\"administrator\"]\n }\n}\n<\/code><\/pre>\n\nREST Errors<\/h3>\n\n
code<\/code>, a message<\/code>, and a data.status<\/code> HTTP status. Common codes include:<\/p>\n\n\n
simplejwt_missing_credentials<\/code> \u2014 Username or password is missing.<\/li>\nsimplejwt_invalid_username<\/code> \u2014 The username is not registered on this site.<\/li>\nsimplejwt_incorrect_password<\/code> \u2014 The password is incorrect.<\/li>\nsimplejwt_no_auth_header<\/code> \u2014 The Authorization header is missing.<\/li>\nsimplejwt_bad_auth_header<\/code> \u2014 The Authorization header is malformed.<\/li>\nsimplejwt_invalid_token<\/code> \u2014 The access token is invalid (bad signature, malformed, or not yet valid).<\/li>\nsimplejwt_expired_token<\/code> \u2014 The access or refresh token has expired.<\/li>\nsimplejwt_invalid_refresh_token<\/code> \u2014 The refresh token is unknown or invalid.<\/li>\nsimplejwt_reused_refresh_token<\/code> \u2014 A rotated refresh token was reused; the token family was revoked.<\/li>\nsimplejwt_revoked_token<\/code> \u2014 The token has been revoked.<\/li>\nsimplejwt_bad_issuer<\/code> \u2014 The token issuer does not match this server.<\/li>\nsimplejwt_unsupported_algorithm<\/code> \u2014 The configured signing algorithm is unsupported.<\/li>\nsimplejwt_rate_limited<\/code> \u2014 Too many requests; please try again later.<\/li>\nsimplejwt_bad_config<\/code> \u2014 JWT authentication is not configured or is disabled.<\/li>\nsimplejwt_bad_encryption_key<\/code> \u2014 The key-encryption-key is not configured.<\/li>\nsimplejwt_invalid_enckey_length<\/code> \u2014 The key-encryption-key is not exactly 32 characters.<\/li>\nsimplejwt_kek_mismatch<\/code> \u2014 The key-encryption-key was rotated; re-enter the signing keys.<\/li>\n<\/ul>\n\nAvailable Hooks<\/h3>\n\n
simplejwt_cors_allow_headers (filter)<\/h4>\n\n
Access-Control-Allow-Headers<\/code> value. Default: Access-Control-Allow-Headers, Content-Type, Authorization<\/code>.<\/p>\n\nadd_filter( 'simplejwt_cors_allow_headers', function ( $headers ) {\n return $headers;\n} );\n<\/code><\/pre>\n\nsimplejwt_auth_iss (filter)<\/h4>\n\n
iss<\/code> (issuer) claim. Default: get_bloginfo( 'url' )<\/code>.<\/p>\n\nadd_filter( 'simplejwt_auth_iss', function ( $iss ) {\n return $iss;\n} );\n<\/code><\/pre>\n\nsimplejwt_not_before (filter)<\/h4>\n\n
nbf<\/code> (not-before) claim. Default: the issue time.<\/p>\n\nadd_filter( 'simplejwt_not_before', function ( $not_before, $issued_at ) {\n return $not_before;\n}, 10, 2 );\n<\/code><\/pre>\n\nsimplejwt_auth_expire (filter)<\/h4>\n\n
exp<\/code> (expiry) claim. Default: time() + access token lifetime<\/code> (900 seconds by default).<\/p>\n\nadd_filter( 'simplejwt_auth_expire', function ( $expire, $issued_at ) {\n return $expire;\n}, 10, 2 );\n<\/code><\/pre>\n\nsimplejwt_payload_before_sign (filter)<\/h4>\n\n
iss<\/code>, iat<\/code>, nbf<\/code>, exp<\/code>, sub<\/code>, and jti<\/code> claims (plus the legacy data.user.id<\/code>).<\/p>\n\nadd_filter( 'simplejwt_payload_before_sign', function ( $payload, $user ) {\n return $payload;\n}, 10, 2 );\n<\/code><\/pre>\n\nsimplejwt_token_before_dispatch (filter)<\/h4>\n\n
add_filter( 'simplejwt_token_before_dispatch', function ( $data, $user ) {\n return $data;\n}, 10, 2 );\n<\/code><\/pre>\n\nsimplejwt_auth_token_reuse_detected (action)<\/h4>\n\n
$user_id<\/code>, $family_id<\/code>, $ip<\/code>.<\/p>\n\nadd_action( 'simplejwt_auth_token_reuse_detected', function ( $user_id, $family_id, $ip ) {\n \/\/ Alert, log, or revoke further sessions here.\n}, 10, 3 );\n<\/code><\/pre>\n\nsimplejwt_rate_limit_max (filter)<\/h4>\n\n
10<\/code>.<\/p>\n\nadd_filter( 'simplejwt_rate_limit_max', function ( $max ) {\n return $max;\n} );\n<\/code><\/pre>\n\nsimplejwt_rate_limit_window (filter)<\/h4>\n\n
MINUTE_IN_SECONDS<\/code> (60).<\/p>\n\nadd_filter( 'simplejwt_rate_limit_window', function ( $window ) {\n return $window;\n} );\n<\/code><\/pre>\n\nPostman Collection<\/h3>\n\n
\/me<\/code> requests.<\/p>\n\n\nUsing FTP<\/h4>\n\n
\n
simple-jwt-auth.zip<\/code> file.<\/li>\nsimple-jwt-auth<\/code> folder to the \/wp-content\/plugins\/<\/code> directory.<\/li>\nUploading from the dashboard<\/h4>\n\n
\n
simple-jwt-auth.zip<\/code> file.<\/li>\n\n
Where can I find the source code?<\/h3><\/dt>\n
How can I contribute?<\/h3><\/dt>\n
Where can I report a bug?<\/h3><\/dt>\n
Why do I get \"Encryption key is not configured properly\"?<\/h3><\/dt>\n