LocoAI
89LocoAI - Auto Translate For Loco Translate is a powerful tool for developers looking to quickly translate thei...
Free
70k+ installs 4.9★ (637)
API Bearer Auth
Access and refresh tokens based authentication plugin for the REST API.
The facts
- Rating
- 5★ from 6
- Active installs
- 300+
- Price
- Free
- Last updated
- 8 Dec 2025
- Added
- Dec 2017
- Requires WP
- 4.6
- Tested up to
- WP 6.9.7
- Requires PHP
- 5.4.0
- Downloads
- 24,312
Our analysis
AI-assistedAPI Bearer Auth is a WordPress plugin that facilitates authentication for the REST API using JWT access and refresh tokens. After logging in, users receive access and refresh tokens for subsequent requests. The plugin allows for token revocation from the user admin screen and requires configuration in the wp-config.php file for optimal functionality.
This plugin is suitable for developers or site administrators looking to implement secure authentication for their REST API endpoints. It ensures that all endpoints require authentication unless specifically whitelisted, enhancing the security of API interactions.
Best for: This plugin suits developers and site administrators needing secure REST API authentication.
What it does well
- ✓Enables JWT authentication for REST API
- ✓Allows token revocation from user admin screen
- ✓Supports custom secret key for added security
- ✓Active user base of 300 installs
- ✓High rating of 5 out of 5 from 6 ratings
Where it falls short
- •Requires manual configuration in wp-config.php
- •All endpoints require authentication unless whitelisted
Verdict
API Bearer Auth provides a straightforward solution for implementing JWT authentication in WordPress. It is a solid choice for those familiar with API security practices.
From the developer
michielve's own description of API Bearer Auth, lightly tidied.
The API Bearer Auth plugin enables authentication for the REST API by using JWT access an refresh tokens. After the user logs in, the access and refresh tokens are returned and can be used for the next requests. Issued tokens can be revoked from within the users admin screen. See below for the endpoints.
Note that after activating this plugin, all REST API endpoints will need to be authenticated, unless the endpoint is whitelisted in the api_bearer_auth_unauthenticated_urls filter (see FAQ for how to use this filter).
JWT
Access tokens can be formatted as JWT tokens. For this to work, you first have to create a secret and add it to the wp-config.php file. If you don’t do this, access tokens will work also, but are just random strings. To create a random secret key, you can do for example:
base64_encode(openssl_random_pseudo_bytes(64));
And then add the result to wp-config:
define('API_BEARER_JWT_SECRET', 'mysecretkey');
If you have problems, you can verify your JWT tokens at: https://jwt.io/
Revoke tokens
This plugin adds a column to the users table in de admin where you can see when a token expires. You can also revoke tokens by selection the “Revoke API tokens” from the bulk actions select box.
API endpoints
Note that all endpoints expect JSON in the POST body.
Login
Endpoint:
POST /api-bearer-auth/v1/login
Request body:
Tagged as
Alternatives
Other plugins for integrating services.
The AI + Automation plugin for WordPress. Automate workflows across all your plugins and apps, add an AI agent...
Free
40k+ installs 4.9★ (156)
Create custom interactive maps with free Leaflet-based styles, no Google Maps API key, frontend marker submiss...
Free
10k+ installs 5★ (67)
Activity Log
87Monitor every change on your WordPress site — who did what, when, and where it came from — for a complete audi...
Free
200k+ installs 4.3★ (74)
Reviews Feed
87No API key required. Display Yelp and Google reviews for any business in a clean, customizable feed on your si...
Free
100k+ installs 4.4★ (34)
Contact Form, Google Sheet, MailChimp, Brevo, Webhook, Zoho CRM Automation and Integration plugin that Connect...
Free
20k+ installs 4.9★ (160)