#154 by installs
WooCommerce Legacy REST API
The WooCommerce Legacy REST API, which is now part of WooCommerce itself but will be removed in WooCommerce 9.0.
- Installs
- 400,000+
- Rating
- 1.5 (29)
- Updated
- 17 days ago
JWT Authentication for WP REST API
Extends the WP REST API using JSON Web Tokens Authentication as an authentication method.
- Active installs
- 60,000+
- #682 of 1,000
- Downloads, all time
- 958.9K
- 958,868
- Downloads, 30 days
- 8.8K
- 2K in the last 7
- Rating
- 4.4 / 5
- 53 reviews
- Last updated
- 8 months ago
- Feb 18, 2026
- Version
- 1.5.0
- 21 releases
Upkeep and compatibility
| Last updated | February 18, 2026Updated in the last year |
|---|---|
| Tested up to | WordPress 6.9.11Older than WordPress 7.1.4, the current release |
| Needs WordPress | 4.2 or newer |
| Needs PHP | 7.4.0 or newer |
| First published | September 5, 2015 |
| Support, last two months | No threads opened |
Reviews
4.4 / 5 from 53 reviews
| 5 stars | 42 |
|---|---|
| 4 stars | 2 |
| 3 stars | 2 |
| 2 stars | 1 |
| 1 star | 6 |
Downloads, last 30 days
What the author says it does
This plugin seamlessly extends the WP REST API, enabling robust and secure authentication using JSON Web Tokens (JWT). It provides a straightforward way to authenticate users via the REST API, returning a standard JWT upon successful login.
Key features of this free version include:
- Standard JWT Authentication: Implements the industry-standard RFC 7519 for secure claims representation.
- Simple Endpoints: Offers clear /token and /token/validate endpoints for generating and validating tokens.
- Configurable Secret Key: Define your unique secret key via wp-config.php for secure token signing.
- Optional CORS Support: Easily enable Cross-Origin Resource Sharing support via a wp-config.php constant.
- Developer Hooks: Provides filters (jwt_auth_expire, jwt_auth_token_before_sign, etc.) for customizing token behavior.
JSON Web Tokens are an open, industry standard method for representing claims securely between two parties.
For users requiring more advanced capabilities such as multiple signing algorithms (RS256, ES256), token refresh/revocation, UI-based configuration, or priority support, consider checking out JWT Authentication PRO.
Support and Requests: Please use GitHub Issues. For priority support, consider upgrading to PRO.
REQUIREMENTS
WP REST API V2
This plugin was conceived to extend the WP REST API V2 plugin features and, of course, was built on top of it.
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
Does this plugin support algorithms other than HS256?
The free version only supports HS256. For support for RS256, ES256, and other algorithms, please consider JWT Authentication PRO.
Can I manage settings without editing wp-config.php?
The free version requires editing wp-config.php. JWT Authentication PRO provides a full settings UI within the WordPress admin.
Is there a way to refresh or revoke tokens?
Token refresh and revocation features are available in JWT Authentication PRO.
Where can I get faster support?
Priority support is included with JWT Authentication PRO. For free support, please use the GitHub issues tracker.
How secure is JWT authentication?
JWT authentication is very secure when implemented correctly. Make sure to use a strong secret key and keep it confidential. JWT Auth PRO offers additional security features like rate limiting and token revocation.
Latest changelog entry
- Security: Updated dependencies to latest secure versions (deep-copy, php-parser, phpunit)
- Feature: Smart upgrade prompts that appear based on actual plugin usage rather than immediately after installation
- Feature: Usage-based notifications showing real token activity in the dashboard for more relevant upgrade recommendations
- Improvement: Better first-time experience – new users won’t see upgrade prompts until they’ve had a chance to use the plugin
- Fix: UTM tracking on upgrade links now works correctly to measure campaign effectiveness
Tagged
Plugins that share its tags
#513 by installs
Disable REST API
Disable the use of the REST API on your website to site users. Now with User Role support!
- Installs
- 80,000+
- Rating
- 4.8 (38)
- Updated
- 3 years ago
#577 by installs
Make Connector
Make Connector. Make lets you design, build, and automate by connecting with WordPress in just a few clicks.
- Installs
- 70,000+
- Rating
- 2.7 (25)
- Updated
- 9 months ago
#926 by installs
WPGraphQL
WPGraphQL adds a flexible and powerful GraphQL API to WordPress, enabling efficient querying and interaction with your site's data.
- Installs
- 30,000+
- Rating
- 4.9 (48)
- Updated
- 2 days ago
#964 by installs
Disable WP REST API
Disables the WP REST API for visitors not logged into WordPress.
- Installs
- 30,000+
- Rating
- 4.8 (36)
- Updated
- 3 months ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin. The author takes donations at their donate page.