JSON Web Token (JWT) Authentication in WordPress

A comprehensive guide on integrating JSON Web Token (JWT) authentication into WordPress. Learn how to secure WordPress REST API and use JWT to manage user login sessions.

In this article, we will explore how to set up and configure JSON Web Token (JWT) authentication in WordPress. JWT is a simple and effective solution for securing WordPress REST API, especially useful for authenticating users in communication between different systems.

PHP Code and Configuration Instructions

1. Install the JWT Authentication for WP REST API plugin:

   • Go to your WordPress Dashboard.
   • Navigate to "Plugins" > "Add New".
   • Search for "JWT Authentication for WP REST API" and install the plugin.
   • Activate the plugin.

2. Configure wp-config.php file:

   • Add the following lines to your wp-config.php file to enable JWT:

   define('JWT_AUTH_SECRET_KEY', 'your-top-secret-key');
   define('JWT_AUTH_CORS_ENABLE', true);
   

   • Replace 'your-top-secret-key' with a strong secret key.

3. Generate a security key for JWT: You can generate a strong secret key using a random string generator or via openssl:

   openssl rand -base64 32
   

4. Test JWT with the REST API:

   • Login: Send a POST request to /wp-json/jwt-auth/v1/token with user credentials:

     POST /wp-json/jwt-auth/v1/token
     Content-Type: application/json
     
     {
       "username": "your-username",
       "password": "your-password"
     }
     

   • If successful, the response will include a JWT token to be used in future requests.

5. Send authenticated requests: Once you have the JWT, include it in the Authorization header of your requests:

   GET /wp-json/wp/v2/posts
   Authorization: Bearer your-jwt-token
   

Detailed explanation:

1. Install the plugin: The JWT Authentication plugin enables JWT authentication for WordPress REST API.
2. Configure wp-config.php: Set environment variables to securely handle JWT-based user authentication.
3. Generate a security key: The key is used to encode and decode JWT, ensuring user login information is secure.
4. Login via API: With user credentials, the API returns a JWT representing the user's session.
5. Send authenticated requests: Any request to the REST API needs to include the JWT in the Authorization header to authenticate.

System requirements:

• WordPress version 5.0 or higher.
• PHP version 7.2 or higher.
• JWT Authentication for WP REST API plugin.

Installation steps:

1. Install the JWT Authentication for WP REST API plugin from the WordPress plugin directory.
2. Configure the wp-config.php file with the secret key for JWT.

Tips:

• Use HTTPS to secure REST API requests when sending JWT.
• Ensure your JWT secret key is unique and not publicly shared.
• Use additional security plugins like Wordfence to further protect your WordPress site.

---