Codevendor

<p>The Token Manager allows web developers to program PHP, HTML, CSS and JavaScript into tokens that can be used throughout WordPress. Tokens can be placed into themes, templates, pages, widgets, etc. The code in the token is processed and then injected into the token name. It allows web developers to package their code into components for easy reuse and maintenance while speeding up development time and distribution. The tokens are also aware of WordPress and can utilize all the common libraries and database from within the token. This allows for unlimited possibilities with web page design, third party api, WordPress api, PHP frameworks, web 2.0, other WordPress plugins, etc. The tokens can even be used within other tokens for replacement of text, making HTML, CSS, JS, fully dynamic.</p>
<h4>MultiSite</h4>
<p>The Token Manager has been built to work with WordPress MultiSite as well as single blog installations. By activating it on the network, it will add the capabilities to control tokens across WordPress sites and blogs. It will also store all tokens in custom tables that are not attached to WordPress, allowing for easy upgrades, backup and version changes.</p>
<h4>Token Management</h4>
<p>The management of tokens is very simple, with built in ajax controls to allow assignment of tokens to individual and all pages. It also separates out frontpage assignment, giving you the freedom to control exactly what is seen on the frontpage. The manager also keeps track of who created and last updated the tokens in WordPress.</p>
<h4>Token Parameters</h4>
<p>The Token Manager now supports token parameters. You can specify a string or integer parameter by adding them behind the token name. You can then access the parameter from within the token code, allowing for unlimited code possibilities.</p>
<h4>Error Handling</h4>
<p>PHP and token errors are handled by the Token Manager and can be displayed by turning on custom settings in the manager. This gives developers the full control to know where errors are occurring within their token code. The error setting can also be turned off for live sites. This protects you from displaying error information on public sites. All errors that occur in the tokens, unless fatal, will not stop the webpage from being displayed. So feel free to code your ideas without worring about errors halting WordPress.</p>
<h4>Token Manager (Standard) Features</h4>
<ul>
<li>Dynamic Processes PHP, HTML, CSS, JS</li>
<li>Token Management, Add, Edit, Delete</li>
<li>Token Parameters</li>
<li>Token Process Ordering</li>
<li>Token Page Assignment</li>
<li>Token Statistics</li>
<li>Token Descriptions</li>
<li>Custom Token Types</li>
<li>Custom Searching and Recordsets</li>
<li>Supports WordPress MultiSite</li>
<li>WordPress aware Tokens</li>
<li>Tokens within Tokens</li>
<li>Error Handling on Webpage, PHP and Tokens</li>
<li>Quick Help Question Marks</li>
</ul>
<h4>Token Manager (Professional) Features</h4>
<ul>
<li>All Standard Features</li>
<li>Global Tokens</li>
<li>External Scripts</li>
<li>Code Versioning</li>
<li>Token History</li>
<li>Backup and Restore Systems</li>
<li>Error Management Systems</li>
<li>Online Technical Support</li>
</ul>
<h4>Future Enhancements For Both</h4>
<ul>
<li>WordPress Token Injection Menus</li>
<li>Code Optimization</li>
<li>Sorting Systems</li>
<li>Better Searching</li>
</ul>
<p>If you have any enhancement suggestions or want to report a bug, please visit http://www.codevendor.com/support/</p>


Token Manager

The Token Manager allows web developers to program PHP, HTML, CSS and JavaScript into tokens that can be used throughout WordPress.

JuanMa Garrido

<p>Unlike basic JWT plugins that use <strong>single long-lived tokens</strong>, JWT Auth Pro implements <strong>modern OAuth 2.0 security best practices</strong> with short-lived access tokens and secure refresh tokens.</p>
<h4>Why JWT Auth Pro?</h4>
<p><strong>The Problem with Basic JWT Plugins:</strong><br />
* Long-lived tokens (24h+) = Higher security risk<br />
* No refresh mechanism = Tokens live until expiry<br />
* XSS vulnerable = Tokens stored in localStorage<br />
* No revocation = Can’t invalidate compromised tokens</p>
<p><strong>JWT Auth Pro Solution:</strong><br />
* Short-lived access tokens (1h default) = Minimal attack window<br />
* Secure refresh tokens = HTTP-only cookies, XSS protected<br />
* Automatic token rotation = Fresh tokens on each refresh<br />
* Complete session control = Revoke any user session instantly</p>
<h4>Features</h4>
<ul>
<li><strong>Simple JWT Authentication</strong> – Clean, stateless token-based auth</li>
<li><strong>HTTPOnly Refresh Tokens</strong> – Secure refresh tokens in HTTP-only cookies</li>
<li><strong>Token Rotation</strong> – Automatic refresh token rotation for enhanced security</li>
<li><strong>CORS Support</strong> – Proper cross-origin request handling</li>
<li><strong>Clean Admin Interface</strong> – Simple configuration in WordPress admin</li>
<li><strong>Developer Friendly</strong> – Clear endpoints and documentation</li>
</ul>
<h4>Security Comparison</h4>
<p>  Feature<br />
  Basic JWT Plugins<br />
  JWT Auth Pro</p>
<p>  Token Lifetime<br />
  Long (hours/days)<br />
  Short (1 hour)</p>
<p>  Refresh Tokens<br />
  None<br />
  Secure HTTP-only</p>
<p>  XSS Protection<br />
  Limited<br />
  HTTP-only cookies</p>
<p>  Token Revocation<br />
  Manual only<br />
  Automatic rotation</p>
<p>  Session Management<br />
  None<br />
  Database tracking</p>
<p>  Security Metadata<br />
  None<br />
  IP + User Agent</p>
<h4>Perfect for:</h4>
<ul>
<li>Single Page Applications (React, Vue, Angular)</li>
<li>Mobile Applications (iOS, Android)</li>
<li>API Integrations (Third-party services)</li>
<li>Headless WordPress (Decoupled architecture)</li>
</ul>
<h4>API Endpoints</h4>
<ul>
<li><code>POST /wp-json/jwt/v1/token</code> – Login and get access token</li>
<li><code>POST /wp-json/jwt/v1/refresh</code> – Refresh access token</li>
<li><code>GET /wp-json/jwt/v1/verify</code> – Verify token and get user info</li>
<li><code>POST /wp-json/jwt/v1/logout</code> – Logout and revoke refresh token</li>
</ul>
<h3>Security</h3>
<ul>
<li><strong>Stateless Authentication</strong> – JWT tokens contain all necessary information</li>
<li><strong>HTTPOnly Cookies</strong> – Refresh tokens stored securely, inaccessible to JavaScript</li>
<li><strong>Token Rotation</strong> – Refresh tokens automatically rotate on use</li>
<li><strong>Configurable Expiration</strong> – Set custom expiration times</li>
<li><strong>IP & User Agent Tracking</strong> – Additional security metadata</li>
</ul>
<h3>Support</h3>
<p>For support and documentation, visit: https://github.com/juanma-wp/jwt-auth-pro-wp-rest-api</p>
<h3>Privacy Policy</h3>
<p>This plugin stores user session data including IP addresses and user agent strings for security purposes. This data is used solely for authentication and security monitoring.</p>


JuanMa JWT Auth Pro

Modern JWT authentication with refresh tokens - built for SPAs and mobile apps with enterprise-grade security.

Token Manager vs JuanMa JWT Auth Pro