JuanMa Garrido

Unlike basic JWT plugins that use single long-lived tokens, JWT Auth Pro implements modern OAuth 2.0 security best practices with short-lived access tokens and secure refresh tokens.
<h4>Why JWT Auth Pro?</h4>
The Problem with Basic JWT Plugins: 
* Long-lived tokens (24h+) = Higher security risk 
* No refresh mechanism = Tokens live until expiry 
* XSS vulnerable = Tokens stored in localStorage 
* No revocation = Can’t invalidate compromised tokens
JWT Auth Pro Solution: 
* Short-lived access tokens (1h default) = Minimal attack window 
* Secure refresh tokens = HTTP-only cookies, XSS protected 
* Automatic token rotation = Fresh tokens on each refresh 
* Complete session control = Revoke any user session instantly
<h4>Features</h4>
<ul>
<li>Simple JWT Authentication – Clean, stateless token-based auth</li>
<li>HTTPOnly Refresh Tokens – Secure refresh tokens in HTTP-only cookies</li>
<li>Token Rotation – Automatic refresh token rotation for enhanced security</li>
<li>CORS Support – Proper cross-origin request handling</li>
<li>Clean Admin Interface – Simple configuration in WordPress admin</li>
<li>Developer Friendly – Clear endpoints and documentation</li>
</ul>
<h4>Security Comparison</h4>
 Feature 
 Basic JWT Plugins 
 JWT Auth Pro
 Token Lifetime 
 Long (hours/days) 
 Short (1 hour)
 Refresh Tokens 
 None 
 Secure HTTP-only
 XSS Protection 
 Limited 
 HTTP-only cookies
 Token Revocation 
 Manual only 
 Automatic rotation
 Session Management 
 None 
 Database tracking
 Security Metadata 
 None 
 IP + User Agent
<h4>Perfect for:</h4>
<ul>
<li>Single Page Applications (React, Vue, Angular)</li>
<li>Mobile Applications (iOS, Android)</li>
<li>API Integrations (Third-party services)</li>
<li>Headless WordPress (Decoupled architecture)</li>
</ul>
<h4>API Endpoints</h4>
<ul>
<li><code>POST /wp-json/jwt/v1/token</code> – Login and get access token</li>
<li><code>POST /wp-json/jwt/v1/refresh</code> – Refresh access token</li>
<li><code>GET /wp-json/jwt/v1/verify</code> – Verify token and get user info</li>
<li><code>POST /wp-json/jwt/v1/logout</code> – Logout and revoke refresh token</li>
</ul>
<h3>Security</h3>
<ul>
<li>Stateless Authentication – JWT tokens contain all necessary information</li>
<li>HTTPOnly Cookies – Refresh tokens stored securely, inaccessible to JavaScript</li>
<li>Token Rotation – Refresh tokens automatically rotate on use</li>
<li>Configurable Expiration – Set custom expiration times</li>
<li>IP & User Agent Tracking – Additional security metadata</li>
</ul>
<h3>Support</h3>
For support and documentation, visit: https://github.com/juanma-wp/jwt-auth-pro-wp-rest-api
<h3>Privacy Policy</h3>
This plugin stores user session data including IP addresses and user agent strings for security purposes. This data is used solely for authentication and security monitoring.

JuanMa JWT Auth Pro

Modern JWT authentication with refresh tokens - built for SPAs and mobile apps with enterprise-grade security.

What is it?
This is a plugin to be used with WP-RESTful Plugin for WordPress, it is not a direct WordPress Plugin. This will not work unless you have WP-RESTful installed and active on your WordPress Installation. 
By using this plugin your REST API will be able to return User information and verify user credentials.
Widget
This Plugin also comes with a fully functional Widget that will enable you to login with other blogs as long as they also use this plugin and allow it. User Sessions are virtualized.
Plugin features?
<ul>
<li>Share user information through the API.</li>
<li>Verify Credentials.</li>
<li>Login with external Blogs.</li>
<li>Session Virtualization. </li>
</ul>
Requirements?
You need to have WP-RESTful installed and active for this Plugin to work.
<h3>Additional help</h3>
You can find additional information by visiting this plugin homepage: http://www.joseairosa.com/2010/06/29/wp-restful-wordpress-plugin/
<h3>What’s in the cooking pan?</h3>
If you have any features that you would like to see implemented, please don’t hesitate to tweet me (http://twitter.com/joseairosa) or mail me (me@joseairosa.com) 🙂

WP RESTful Users Plugin

The WP-RESTful User Plugin is a REST API module to be used with WP-RESTful Plugin for WordPress.

JuanMa JWT Auth Pro vs WP RESTful Users Plugin