oneteamsoftware

<p>Introducing our <strong>Simple REST API Authentication</strong> plugin for WordPress – the ultimate solution for seamless integration between your website and external applications.</p>
<p>This plugin lets you use Basic Authentication for WordPress REST API and other custom-developed endpoints as well as third-party plugin REST API endpoints with <strong>WooCommerce REST API credentials</strong>.</p>
<p>With Simple REST API Authentication plugin, you won’t have to use different credentials or expose your user name and password to upload media to WordPress and then use it for WooCommerce products.</p>
<h4>Features</h4>
<ul>
<li>Seamless integration with WooCommerce REST API credentials for WordPress REST API</li>
<li>Debugging capabilities for troubleshooting</li>
<li>Flexibility to enable or disable the SSL requirement for added security.</li>
</ul>
<p>The WordPress REST API is a powerful tool that makes CRUD (Create, Read, Update & Delete) operations available from anywhere, instead of being limited to the admin dashboard.</p>
<p>It provides a lightweight form of communication between the client and the server, making it a great solution for exchanging data.</p>
<p>This plugin can be used to create iOS/Android, etc native apps, and we can use any language we want as long as the language can make HTTP requests and interpret JSON such as Node.js, Express.js, Ruby, Python etc.</p>
<p>The possibilities are endless with this plugin, and it can be used in hundreds of various scenarios to make your website more accessible, efficient and user-friendly.</p>
<p><strong>Upgrade your website to the next level with our Simple REST API Authentication plugin today!</strong></p>
<p>These are only a few examples of possible use cases and they are only limited by your imagination and requirement.<br />
In case it is not enough, then feel free to <a href="https://1teamsoftware.com/contact-us/" rel="nofollow ugc">Contact Us</a> and we will find a way to meet your requirements.</p>
<h3>PREMIUM PLUGINS</h3>
<ul>
<li><a href="https://1teamsoftware.com/product/woocommerce-free-shipping-per-package-pro/" rel="nofollow ugc">Free Shipping Per Package PRO</a> – Free Shipping based on advanced conditions.</li>
<li><a href="https://1teamsoftware.com/product/woocommerce-chitchats-shipping/" rel="nofollow ugc">ChitChats Shipping</a> – Ship your packages from Canada via USA as if you were physically there.</li>
<li><a href="https://1teamsoftware.com/product/woocommerce-marketplace-cart/" rel="nofollow ugc">Marketplace Cart</a> – Offer Amazon like cart/checkout experience for your customers.</li>
<li><a href="https://1teamsoftware.com/product/woocommerce-package-orders/" rel="nofollow ugc">Package Orders</a> – Automatically create separate orders for items shipped from different locations.</li>
<li><a href="https://1teamsoftware.com/product/woocommerce-product-categories-menu/" rel="nofollow ugc">Product Categories Menu</a> – Automatically add entire structure of product categories to any menu.</li>
<li><a href="https://1teamsoftware.com/product/woocommerce-sticky-product-bar-pro/" rel="nofollow ugc">Sticky Product Bar PRO</a> – Adds a number of amazing features to a a highly configurable sticky product bar.</li>
</ul>
<h3>FREE PLUGINS</h3>
<ul>
<li><a href="https://1teamsoftware.com/product/woocommerce-shipping-packages/" rel="nofollow ugc">Shipping Packages</a> – Split your cart into packages that can be shipped with different shipping methods.</li>
<li><a href="https://1teamsoftware.com/product/woocommerce-sticky-product-bar/" rel="nofollow ugc">Sticky Product Bar</a> – Display sticky bar with product details, rating and add to cart button.</li>
<li><a href="https://1teamsoftware.com/product/woocommerce-shipping-packages/" rel="nofollow ugc">Shipping Packages</a> – Split your cart into packages that can be shipped with different shipping methods.</li>
<li><a href="https://1teamsoftware.com/product/woocommerce-shipping-discount/" rel="nofollow ugc">Shipping Discount</a> – Configurable shipping discount rules based on the amount spent for the items with a given shipping class.</li>
</ul>


Simple REST API Authenticaton with WooCommerce Credentials

Simple REST API Authentication plugin for WordPress - a powerful solution for integrating your website with external applications.

Sayan Dey

<p>Extends the WordPress REST API using JSON Web Tokens for robust authentication and authorization.</p>
<p>JSON Web Token (JWT) is an open standard (<a href="https://tools.ietf.org/html/rfc7519" rel="nofollow ugc">RFC 7519</a>) that defines a compact and self-contained way for securely transmitting information between two parties.</p>
<p>It provides a secure and reliable way to access and manage WordPress data from external applications, making it ideal for building headless CMS solutions.</p>
<ul>
<li>Support & question: <a href="https://wordpress.org/support/plugin/simple-jwt-auth/" rel="ugc">WordPress support forum</a></li>
<li>Reporting plugin’s bug: <a href="https://github.com/sayandey18/simple-jwt-auth/issues" rel="nofollow ugc">GitHub issues tracker</a></li>
</ul>
<p><strong>Plugins GitHub Repo</strong> https://github.com/sayandey18/simple-jwt-auth</p>
<h3>Enable PHP HTTP Authorization Header</h3>
<p>HTTP Authorization is a mechanism that allows clients to provide credentials to servers, thereby gaining access to protected resources. This is typically achieved by sending a special header, the Authorization header, in the HTTP request.</p>
<h4>Shared Hosts</h4>
<p>Most shared hosts have disabled the <strong>HTTP Authorization Header</strong> by default.</p>
<p>To enable this option you’ll need to edit your <strong>.htaccess</strong> file by adding the following:</p>
<pre><code>RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
</code></pre>
<h4>WPEngine</h4>
<p>To enable this option you’ll need to edit your .htaccess file adding the follow:</p>
<pre><code>SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</code></pre>
<h3>Configuration</h3>
<p>Simple JWT Auth plugin needs a <strong>Signing Key</strong> to encrypt and decrypt the <strong>secret key</strong>, <strong>private key</strong>, and <strong>public key</strong>. This signing key must be exact 32 charecter long and never be revealed.</p>
<p>To add the <strong>signing key</strong> edit your <code>wp-config.php</code> file and add a new constant called <strong>SIMPLE_JWT_AUTH_ENCRYPT_KEY</strong></p>
<pre><code>define( 'SIMPLE_JWT_AUTH_ENCRYPT_KEY', 'your-32-char-signing-key' );
</code></pre>
<p>Generate a 32 charecter key from here: <a href="https://string-gen.netlify.app" rel="nofollow ugc">https://string-gen.netlify.app</a></p>
<p>Here is the sample response if the encryption key is not configured in wp-config.php file.</p>
<pre><code>{
    "code": "simplejwt_bad_encryption_key",
    "message": "Encryption key is not configured properly.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h3>REST Endpoints</h3>
<p>When the plugin is activated, a new namespace is added.</p>
<pre><code>/auth/v1
</code></pre>
<p>Also, two new endpoints are added to this namespace.</p>
<pre><code>*/wp-json/auth/v1/token          | POST
*/wp-json/auth/v1/token/validate | POST
</code></pre>
<h3>Requesting/Generating Token</h3>
<p>To generate a new token, submit a POST request to this endpoint. With <code>username</code> and <code>password</code> as the parameters.</p>
<p>It will validates the user credentials, and returns success response including a token if the authentication is correct or returns an error response if the authentication is failed.</p>
<pre><code>curl --location 'https://example.com/wp-json/auth/v1/token' \
--header 'Content-Type: application/json' \
--data-raw '{
    "username": "wordpress_username",
    "password": "wordpress_password"
}'
</code></pre>
<h4>Sample of success response</h4>
<pre><code>{
    "code": "simplejwt_auth_credential",
    "message": "Token created successfully",
    "data": {
        "status": 200,
        "id": "2",
        "email": "sayandey@outlook.com",
        "nicename": "sayan_dey",
        "display_name": "Sayan Dey",
        "token": "eyJ0eXAiOiJKV1QiLCJhbGciO........."
    }
}
</code></pre>
<h4>Sample of error response</h4>
<pre><code>{
    "code": "simplejwt_invalid_username",
    "message": "Error: The username admin_user is not registered on this site. If you are unsure of your username, try your email address instead.",
    "data": {
        "status": 403
    }
}
</code></pre>
<p>Once you get the token, you can store it somewhere in your application:</p>
<ul>
<li>using <strong>Cookie</strong> </li>
<li>or using <strong>localstorage</strong> </li>
<li>or using a wrapper like <a href="https://localforage.github.io/localForage/" rel="nofollow ugc">localForage</a> or <a href="https://pouchdb.com/" rel="nofollow ugc">PouchDB</a></li>
<li>or using local database like SQLite</li>
<li>or your choice based on app you develop</li>
</ul>
<p>Then you should pass this token as <em>Bearer Authentication</em> header to every API call.</p>
<pre><code>Authorization: Bearer your-generated-token
</code></pre>
<p>Here is an example to create WordPress post using JWT token authentication.</p>
<pre><code>curl --location 'https://example.com/wp-json/wp/v2/posts' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciO.........' \
--data '{
    "title": "Dummy post through API",
    "content": "Lorem Ipsum is simply dummy text of the printing and typesetting industry.",
    "status": "publish",
    "tags": [
        4,
        5,
        6
    ]
}'
</code></pre>
<p>Plugin’s middleware intercepts every request to the server, checking for the presence of the <strong>Authorization</strong> header. If the header is found, it attempts to decode the JWT token contained within.</p>
<p>Upon successful decoding, the middleware extracts the user information stored in the token and authenticates the user accordingly, ensuring that only authorized requests are processed.</p>
<h3>Validating Token</h3>
<p>This is a helper endpoint to validate a token. You only will need to make a <strong>POST</strong> request sending the Bearer Authorization header.</p>
<pre><code>curl --location --request POST 'https://example.com/wp-json/auth/v1/token/validate' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciO.........'
</code></pre>
<h4>Sample of success response</h4>
<pre><code>{
    "code": "simplejwt_valid_token",
    "message": "Token is valid",
    "data": {
        "status": 200
    }
}
</code></pre>
<h3>REST Errors</h3>
<p>If the token is invalid an error will be returned, here are some samples of errors.</p>
<h4>Invalid Username</h4>
<pre><code>{
    "code": "simplejwt_invalid_username",
    "message": "Error: The username admin is not registered on this site. If you are unsure of your username, try your email address instead.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Password</h4>
<pre><code>{
    "code": "simplejwt_incorrect_password",
    "message": "Error: The password you entered for the username tiyasha_das is incorrect. Lost your password?",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Signature</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Signature verification failed",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Syntax error, malformed JSON",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Expired Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Expired token",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>No Authorization</h4>
<pre><code>{
    "code": "simplejwt_no_auth_header",
    "message": "Authorization header not found",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Authorization</h4>
<pre><code>{
    "code": "simplejwt_bad_auth_header",
    "message": "Authorization header malformed",
    "data": {
        "status": 400
    }
}
</code></pre>
<h4>Wrong Algorithm Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Incorrect key for this algorithm",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Unsupported Algorithm</h4>
<pre><code>{
    "code": "simplejwt_unsupported_algorithm",
    "message": "Unsupported algorithm see https://tinyurl.com/uf4ns6fm",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Configuration</h4>
<pre><code>{
    "code": "simplejwt_bad_config",
    "message": "JWT is not configured properly, please contact the admin",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Encryption Key</h4>
<pre><code>{
    "code": "simplejwt_bad_encryption_key",
    "message": "Encryption key is not configured properly.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Encryption Key Length</h4>
<pre><code>{
    "code": "simplejwt_invalid_enckey_length",
    "message": "Encryption key must be exactly 32 characters long",
    "data": {
        "status": 400
    }
}
</code></pre>
<h3>Available Hooks</h3>
<p><strong>Simple JWT Auth</strong> is a developer-friendly plugin. It has various filter hooks available to override the default settings.</p>
<h4>simplejwt_cors_allow_headers</h4>
<p>The <code>simplejwt_cors_allow_headers</code> allows you to modify the available headers when the Cross-Origin Resource Sharing (CORS) support is enabled.</p>
<p>Default value:</p>
<pre><code>'Access-Control-Allow-Headers, Content-Type, Authorization'
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the allowed CORS headers.
 *
 * @param   string $headers The allowed headers.
 * @return  string The allowed headers.
 */
add_filter("simplejwt_cors_allow_headers", function ($headers) {
    // Modify the headers here.
    return $headers;
});
</code></pre>
<h4>simplejwt_auth_iss</h4>
<p>The <code>simplejwt_auth_iss</code> allows you to change the <a href="https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1" rel="nofollow ugc"><strong>iss</strong></a> value before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>get_bloginfo( 'url' );
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token issuer.
 *
 * @param   string $iss The token issuer.
 * @return  string The token issuer.
 */
add_filter("simplejwt_auth_iss", function ($iss) {
    // Modify the "iss" here.
    return $iss;
});
</code></pre>
<h4>simplejwt_not_before</h4>
<p>The <code>simplejwt_not_before</code> allows you to change the <a href="https://tools.ietf.org/html/rfc7519#section-4.1.5" rel="nofollow ugc"><strong>nbf</strong></a> value before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>time();
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token's nbf value.
 *
 * @param   int $not_before The default "nbf" value in timestamp.
 * @param   int $issued_at The "iat" value in timestamp.
 * @return  int The "nbf" value.
 */
add_filter(
    "simplejwt_not_before",
    function ($not_before, $issued_at) {
        // Modify the "not_before" here.
        return $not_before;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_auth_expire</h4>
<p>The <code>simplejwt_auth_expire</code> allows you to change the value <a href="https://tools.ietf.org/html/rfc7519#section-4.1.4" rel="nofollow ugc"><strong>exp</strong></a> before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>time() + ( DAY_IN_SECONDS * 7 )
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token's expire value.
 *
 * @param   int $expire The default "exp" value in timestamp.
 * @param   int $issued_at The "iat" value in timestamp.
 * @return  int The "nbf" value.
 */
add_filter(
    "simplejwt_auth_expire",
    function ($expire, $issued_at) {
        // Modify the "expire" here.
        return $expire;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_payload_before_sign</h4>
<p>The <code>simplejwt_payload_before_sign</code> allows you to modify all the payload data before being encoded and signed.</p>
<p>Default value:</p>
<pre><code>$payload = [
    "iss" => $this->simplejwt_get_iss(),
    "iat" => $issued_at,
    "nbf" => $not_before,
    "exp" => $expire,
    "data" => [
        "user" => [
            "id" => $user->data->ID,
        ],
    ],
];
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Modify the payload data before being encoded & signed.
 *
 * @param   array $payload The default payload
 * @param   WP_User $user The authenticated user.
 * @return  array The payloads data.
 */
add_filter(
    "simplejwt_payload_before_sign",
    function ($payload, $user) {
        // Modify the payload here.
        return $payload;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_token_before_dispatch</h4>
<p>The <code>simplejwt_token_before_dispatch</code> allows you to modify the token response before to dispatch it to the client.</p>
<p>Default value:</p>
<pre><code>$data = new WP_REST_Response(
    [
        "code" => "simplejwt_auth_credential",
        "message" => JWTNotice::get_notice("auth_credential"),
        "data" => [
            "status" => 200,
            "id" => $user->data->ID,
            "email" => $user->data->user_email,
            "nicename" => $user->data->user_nicename,
            "display_name" => $user->data->display_name,
            "token" => $token,
        ],
    ],
    200,
);
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Modify the JWT response before dispatch.
 *
 * @param   WP_REST_Response $data The token response data.
 * @param   WP_User $user The user object for whom the token is being generated.
 * @return  WP_REST_Response Modified token response data.
 */
add_filter(
    "simplejwt_token_before_dispatch",
    function ($data, $user) {
        // Modify the response data.
        if ($user instanceof WP_User) {
        }
        return $data;
    },
    10,
    2,
);
</code></pre>
<h3>Credits</h3>
<ul>
<li><a href="https://developer.wordpress.org/rest-api/" rel="nofollow ugc">WordPress REST API</a></li>
<li><a href="https://github.com/firebase/php-jwt" rel="nofollow ugc">php-jwt by Firebase</a></li>
</ul>


Simple JWT Auth

Extends the WP REST API using JSON Web Tokens for robust authentication, providing a secure and reliable way to access and manage WordPress data.

Simple REST API Authenticaton with WooCommerce Credentials vs Simple JWT Auth