by miniOrange 4.4 (74 reviews)

JWT Authentication for WP REST APIs

Name: JWT Authentication for WP REST APIs
Rating: 4.4 (74 reviews)
Author: miniOrange

Secure and protect WordPress REST API from unauthorized access using JWT token, Basic Authentication, API Key, OAuth 2, or external token.

JWT Authentication for WP REST APIs ranks #1,437 among WordPress.org plugins with 10,000+ active installations, is #61 of 1,578 in the Authentication category, a 4.4/5 rating from 74 reviews, and was last updated Sep 10, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v4.8.0 Current Version v4.8.0

Updated 6 days ago Last Update on 10 Sep, 2026

Refreshed 7 hours ago Last Refreshed on

#61 of 1,578 in Authentication Top 5% by installs Downloads -8.1% this week Actively maintained

View on WordPress.org

Rank

#1,437

-1 this week

Active Installs

10K+

-53%

KW Avg Position

8.6

0.4 better

Downloads

492.2K

+78 today

Support Resolved

— No change

Rating

88%

Review 4.4 out of 5

4.4 (74 reviews)

Next Milestone 20K

Total Progress 98%

10K+ 20K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 200 more installs to reach 20K+

Rank Changes

Current #1,437

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.4

74 reviews

Overall 88%

62 (84%)

0 (0%)

2 (3%)

1 (1%)

9 (12%)

Security History

Source: WPVulnerability

2 known vulnerabilities on record · 1 in the last 24 months · checked 1 week ago

Apr 16, 2025

JWT Authentication for WP REST APIs [wp-rest-api-authentication] < 3.6.4

CVE-2025-39545 · Fixed in v3.6.4
Nov 9, 2022

JWT Authentication for WP REST APIs [wp-rest-api-authentication] < 2.4.1

CVE-2022-45073 · Fixed in v2.4.1

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 4.8.0
Last Updated: Sep 10, 2026
Requires WP: 3.0.1+
Tested Up To: 7.1
PHP Version: 5.6 or higher
Author: miniOrange

Support & Rating

Rating: ★ ★ ★ ★ ☆ 4.4
Reviews: 74
Support Threads: 0
Resolved: 0%

Keywords

API key jwt authentication rest rest-api secure api

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,752

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,007

WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security - Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

1M+ installs

#62

MainWP Child - Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners and developers who need to protect their REST API endpoints from unauthorized access. It solves this by adding authentication methods such as JWT, Basic Auth, API Key, OAuth 2.0, and external token support to secure default, custom, and third-party plugin REST API endpoints.

JWT Authentication
Basic Authentication
API Key Authentication
OAuth 2.0 Authentication
Refresh and Revoke token endpoints
Disable WP REST APIs
Selective API protection
Role-based WP REST API authentication

Frequently Asked Questions

Common questions about JWT Authentication for WP REST APIs

JWT Authentication for WP REST APIs plugin prevents unauthorized access to your WordPress APIs. It reduces potential attack by securing the WP APIs.

This plugin supports 5 methods: i) JWT Token based authentication, ii) authentication through user credentials passed as an encrypted token, iii) API Key authentication, iv) OAuth 2.0 Authentication protocol and v) authentication via JWT token obtained from the external OAuth/OpenId providers which include Google, Facebook, Azure, AWS Cognito, Apple etc and also from Firebase.

You just have to select your WP REST API Authentication Method in the plugin. Based on the method you have selected, you will get the authorization code/token after sending the token request. Access your REST API with the code/token you received in the previous step.

Yes, the plugin provides Basic authentication with the following 2 methods - a.) WP Username & Password b.) Client Credentials. The plugin provides you with more security for Basic auth token validation using a highly secure HMAC algorithm.

Yes, the plugin supports the authentication for custom-built REST endpoints and Third-Party plugin APIs.

Yes, this plugin by default disables all the WP REST APIs, which can only be accessed with allowed authentication and authorization, but it provides a feature where you can choose which particular endpoints you want to disable and which ones to make accessible publicly.

This plugin provides this HTTP POST endpoint wp-json/api/v1/token, also called as WordPress login API endpoint, in which you can pass the user's WordPress credentials and this endpoint will validate the user and return you with the appropriate response. The plugin also supports the WP REST API authentication and authorization of WordPress users' register API.

This plugin provides you with an WP REST API Authentication method called the 'Third Party Provider' authentication method, in which the JWT token or access token is obtained from external identities(OAuth/OIDC/JWT/JWKS providers) like Firebase, Okta, Azure, Keycloak, ADFS, AWS Cognito, Google, Facebook, Apple, etc., can be passed along with API request in the header, and the plugin validates that JWT / access token directly from these external sources/providers.

This plugin provides a way to bypass Woocommerce security and instead authenticate APIs using the authentication methods, hence improving the security and preventing Woocommerce credentials from getting compromised. The authentication token passed in the API request will validate the user and result in user-specific data only. For more information, please contact us at apisupport@xecurify.com

To achieve the auto-login and session sharing, we have another plugin WordPress Login & Register using JWT