JuanMa Garrido

<p>Unlike basic JWT plugins that use <strong>single long-lived tokens</strong>, JWT Auth Pro implements <strong>modern OAuth 2.0 security best practices</strong> with short-lived access tokens and secure refresh tokens.</p>
<h4>Why JWT Auth Pro?</h4>
<p><strong>The Problem with Basic JWT Plugins:</strong><br />
* Long-lived tokens (24h+) = Higher security risk<br />
* No refresh mechanism = Tokens live until expiry<br />
* XSS vulnerable = Tokens stored in localStorage<br />
* No revocation = Can’t invalidate compromised tokens</p>
<p><strong>JWT Auth Pro Solution:</strong><br />
* Short-lived access tokens (1h default) = Minimal attack window<br />
* Secure refresh tokens = HTTP-only cookies, XSS protected<br />
* Automatic token rotation = Fresh tokens on each refresh<br />
* Complete session control = Revoke any user session instantly</p>
<h4>Features</h4>
<ul>
<li><strong>Simple JWT Authentication</strong> – Clean, stateless token-based auth</li>
<li><strong>HTTPOnly Refresh Tokens</strong> – Secure refresh tokens in HTTP-only cookies</li>
<li><strong>Token Rotation</strong> – Automatic refresh token rotation for enhanced security</li>
<li><strong>CORS Support</strong> – Proper cross-origin request handling</li>
<li><strong>Clean Admin Interface</strong> – Simple configuration in WordPress admin</li>
<li><strong>Developer Friendly</strong> – Clear endpoints and documentation</li>
</ul>
<h4>Security Comparison</h4>
<p>  Feature<br />
  Basic JWT Plugins<br />
  JWT Auth Pro</p>
<p>  Token Lifetime<br />
  Long (hours/days)<br />
  Short (1 hour)</p>
<p>  Refresh Tokens<br />
  None<br />
  Secure HTTP-only</p>
<p>  XSS Protection<br />
  Limited<br />
  HTTP-only cookies</p>
<p>  Token Revocation<br />
  Manual only<br />
  Automatic rotation</p>
<p>  Session Management<br />
  None<br />
  Database tracking</p>
<p>  Security Metadata<br />
  None<br />
  IP + User Agent</p>
<h4>Perfect for:</h4>
<ul>
<li>Single Page Applications (React, Vue, Angular)</li>
<li>Mobile Applications (iOS, Android)</li>
<li>API Integrations (Third-party services)</li>
<li>Headless WordPress (Decoupled architecture)</li>
</ul>
<h4>API Endpoints</h4>
<ul>
<li><code>POST /wp-json/jwt/v1/token</code> – Login and get access token</li>
<li><code>POST /wp-json/jwt/v1/refresh</code> – Refresh access token</li>
<li><code>GET /wp-json/jwt/v1/verify</code> – Verify token and get user info</li>
<li><code>POST /wp-json/jwt/v1/logout</code> – Logout and revoke refresh token</li>
</ul>
<h3>Security</h3>
<ul>
<li><strong>Stateless Authentication</strong> – JWT tokens contain all necessary information</li>
<li><strong>HTTPOnly Cookies</strong> – Refresh tokens stored securely, inaccessible to JavaScript</li>
<li><strong>Token Rotation</strong> – Refresh tokens automatically rotate on use</li>
<li><strong>Configurable Expiration</strong> – Set custom expiration times</li>
<li><strong>IP & User Agent Tracking</strong> – Additional security metadata</li>
</ul>
<h3>Support</h3>
<p>For support and documentation, visit: https://github.com/juanma-wp/jwt-auth-pro-wp-rest-api</p>
<h3>Privacy Policy</h3>
<p>This plugin stores user session data including IP addresses and user agent strings for security purposes. This data is used solely for authentication and security monitoring.</p>


JuanMa JWT Auth Pro

Modern JWT authentication with refresh tokens - built for SPAs and mobile apps with enterprise-grade security.

axtolab

<p>WordPress 7.0 introduced the AI Client and the Connectors screen: you configure an AI provider API key once, and every plugin on your site can use it. What WordPress does not show you is <strong>which plugin is spending your money</strong>.</p>
<p>AI Spend Monitor records every call made through the WordPress AI Client and gives you a clear dashboard under <strong>Axtolab <span aria-hidden="true" class="wp-exclude-emoji">→</span> AI Spend Monitor</strong>:</p>
<ul>
<li><strong>Per-plugin AI usage</strong> — see exactly which plugins and themes make AI calls, with calls, prompt tokens, and completion tokens for each.</li>
<li><strong>Estimated cost per plugin</strong> — token counts are converted to an estimated USD cost using bundled list prices for popular OpenAI, Anthropic, and Google models.</li>
<li><strong>Editable cost rates</strong> — a “Cost rates” tab lets you adjust the per-model input/output prices to match your provider plan or a price change. Saving re-estimates previously recorded calls too, so the whole dashboard reflects your rates. No code required.</li>
<li><strong>Daily cost chart</strong> — a 30-day view of your estimated AI spend, so a sudden spike is visible the day it happens, not when the invoice arrives.</li>
<li><strong>Recent call log</strong> — the latest AI calls with source, provider, model, and token counts.</li>
<li><strong>CSV export</strong> — download the recorded calls for any period for accounting or review: source plugin, provider, model, tokens, and estimated cost per call.</li>
<li><strong>Spend notification</strong> — optionally get one email per month when estimated sitewide AI spend passes a dollar amount you choose.</li>
<li><strong>Zero configuration</strong> — activate it and it starts recording. No API keys, no account, no setup.</li>
</ul>
<h4>How it works</h4>
<p>The plugin listens to the WordPress AI Client’s lifecycle hooks. When any plugin calls the AI Client, the call’s token usage and model metadata are recorded in a local database table, and the calling plugin is identified automatically. Old records are pruned after 90 days (filterable).</p>
<h4>Privacy</h4>
<p>All data stays on your site. The plugin records token counts and metadata only — it does <strong>not</strong> store prompt or response content, and it does <strong>not</strong> send anything to any external service. There are no remote calls, no tracking, and no account requirement.</p>
<h4>For developers</h4>
<ul>
<li><code>aismon_usage_recorded</code> — action fired after each recorded call.</li>
<li><code>aismon_cost_rates</code> — filter the model price table used for estimates.</li>
<li><code>aismon_retention_days</code> — filter the data retention window (default 90 days).</li>
<li><code>aismon_dashboard_after_summary</code> — action to render additional dashboard panels.</li>
</ul>
<h3>External Services</h3>
<p>AI Spend Monitor does <strong>not</strong> contact any external services. All data is recorded and stored locally in your WordPress database — no remote calls, no telemetry, no analytics.</p>
<p>The token-to-USD cost estimates use a pricing table that ships with the plugin (no remote lookup). The table can be overridden via the <code>aismon_cost_rates</code> filter; see the developer notes in the description.</p>
<p>The plugin does not send any data outside your WordPress site.</p>
<h3>Privacy</h3>
<p>AI Spend Monitor records the following data locally, in a custom database table with the standard WordPress table prefix:</p>
<ul>
<li>The source plugin or theme that made each AI call.</li>
<li>The AI provider (e.g. OpenAI, Anthropic, Google) and model identifier (e.g. <code>gpt-4o-mini</code>).</li>
<li>Token counts per call: prompt tokens, completion tokens, total tokens.</li>
<li>A timestamp for each recorded call.</li>
</ul>
<p>The plugin does <strong>not</strong> store any of the following:</p>
<ul>
<li>Prompt or response content.</li>
<li>User identifiers, user emails, or user IP addresses.</li>
<li>Any other personally-identifying information.</li>
<li>Any visitor-facing data — the plugin only sees server-side AI calls made by other plugins or themes.</li>
</ul>
<p>Recorded data is pruned automatically after 90 days. The retention window is filterable via <code>aismon_retention_days</code>. All recorded data, plugin options, and transients are removed when the plugin is uninstalled (see <code>uninstall.php</code>).</p>
<p>No recorded data is sent to any external service. All processing happens on your own WordPress site.</p>


Axtolab AI Spend Monitor

AI usage and cost tracking for the WordPress AI Client. See which plugins make AI calls, how many tokens they use, and what it costs.

JuanMa JWT Auth Pro vs Axtolab AI Spend Monitor