[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLyjpiloRSWMXOhbcqjKJQbFIUAVmgj03AF_6RKPQJBE":3},{"slug":4,"display_name":5,"profile_url":6,"plugin_count":7,"total_installs":8,"avg_security_score":9,"avg_patch_time_days":10,"trust_score":11,"computed_at":12,"plugins":13},"contactjavas","Bagus","https:\u002F\u002Fprofiles.wordpress.org\u002Fcontactjavas\u002F",2,6300,88,438,71,"2026-04-04T10:37:00.683Z",[14,39],{"slug":15,"name":16,"version":17,"author":5,"author_profile":6,"description":18,"short_description":19,"active_installs":20,"downloaded":21,"rating":22,"num_ratings":23,"last_updated":24,"tested_up_to":25,"requires_at_least":26,"requires_php":27,"tags":28,"homepage":32,"download_link":33,"security_score":34,"vuln_count":35,"unpatched_count":36,"last_vuln_date":37,"fetched_at":38},"jwt-auth","JWT Auth – WordPress JSON Web Token Authentication","3.0.2","\u003Cp>WordPress JSON Web Token Authentication allows you to do REST API authentication via token. It is a simple, non-complex, and easy to use. This plugin probably is the most convenient way to do JWT Authentication in WordPress.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Support & question: \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Fjwt-auth\u002F\" rel=\"ugc\">WordPress support forum\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Reporting plugin’s bug: \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fusefulteam\u002Fjwt-auth\u002Fissues\" rel=\"nofollow ugc\">GitHub issues tracker\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdiscord.gg\u002FDgECpEg\" rel=\"nofollow ugc\">Discord channel\u003C\u002Fa> also available for faster response.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Upgrading to v3\u003C\u002Fh3>\n\u003Cp>When updating from v2 to v3, familiarise yourself with its changes to ensure that your site continues to work as expected:\u003C\u002Fp>\n\u003Ch4>New: Refresh tokens ([docs](https:\u002F\u002Fgithub.com\u002Fusefulteam\u002Fjwt-auth#refreshing-the-access-token))\u003C\u002Fh4>\n\u003Cp>Key changes:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Default JWT access token expiry time has been reduced from 7 days to 10 minutes.\u003C\u002Fli>\n\u003Cli>On expiry of a JWT, clients need to retrieve a new access token using the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fusefulteam\u002Fjwt-auth#refreshing-the-access-token\" rel=\"nofollow ugc\">refresh token as described here\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>To retain the 7 day expiry time, use the hook \u003Ccode>jwt_auth_expire\u003C\u002Fcode>.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Removed Whitelist\u003C\u002Fh4>\n\u003Cp>Key changes:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>You no longer need to whitelist REST paths from other plugins with the hook \u003Ccode>jwt_auth_whitelist\u003C\u002Fcode>. You can remove the hook.\u003C\u002Fli>\n\u003Cli>Instead, custom REST API routes should have access requirements specified with the \u003Ca href=\"https:\u002F\u002Fdeveloper.wordpress.org\u002Frest-api\u002Fextending-the-rest-api\u002Fadding-custom-endpoints\u002F#permissions-callback\" rel=\"nofollow ugc\">permissions callback\u003C\u002Fa> when it is registered.\u003C\u002Fli>\n\u003Cli>This means that if a route requires authentication, any authentication method can be used and this should reduce conflicts between this and other plugins. See \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fusefulteam\u002Fjwt-auth\u002Fpull\u002F60\" rel=\"nofollow ugc\">this discussion\u003C\u002Fa> for further information.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Enable PHP HTTP Authorization Header\u003C\u002Fh3>\n\u003Ch4>Shared Hosts\u003C\u002Fh4>\n\u003Cp>Most shared hosts have disabled the \u003Cstrong>HTTP Authorization Header\u003C\u002Fstrong> by default.\u003C\u002Fp>\n\u003Cp>To enable this option you’ll need to edit your \u003Cstrong>.htaccess\u003C\u002Fstrong> file by adding the following:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>RewriteEngine on\nRewriteCond %{HTTP:Authorization} ^(.*)\nRewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>WPEngine\u003C\u002Fh4>\n\u003Cp>To enable this option you’ll need to edit your \u003Cstrong>.htaccess\u003C\u002Fstrong> file by adding the following (see \u003Ca href=\"https:\u002F\u002Fgithub.com\u002FTmeister\u002Fwp-api-jwt-auth\u002Fissues\u002F1\" rel=\"nofollow ugc\">this issue\u003C\u002Fa>):\u003C\u002Fp>\n\u003Cpre>\u003Ccode>SetEnvIf Authorization \"(.*)\" HTTP_AUTHORIZATION=$1\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>Configuration\u003C\u002Fh3>\n\u003Ch4>Configurate the Secret Key\u003C\u002Fh4>\n\u003Cp>The JWT needs a \u003Cstrong>secret key\u003C\u002Fstrong> to sign the token. This \u003Cstrong>secret key\u003C\u002Fstrong> must be unique and never be revealed.\u003C\u002Fp>\n\u003Cp>To add the \u003Cstrong>secret key\u003C\u002Fstrong>, edit your wp-config.php file and add a new constant called \u003Cstrong>JWT_AUTH_SECRET_KEY\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>define('JWT_AUTH_SECRET_KEY', 'your-top-secret-key');\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>You can use a string from \u003Ca href=\"https:\u002F\u002Fapi.wordpress.org\u002Fsecret-key\u002F1.1\u002Fsalt\u002F\" rel=\"nofollow ugc\">here\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch4>Configurate CORs Support\u003C\u002Fh4>\n\u003Cp>This plugin has the option to activate \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCross-origin_resource_sharing\" rel=\"nofollow ugc\">CORs\u003C\u002Fa> support.\u003C\u002Fp>\n\u003Cp>To enable the CORs Support edit your wp-config.php file and add a new constant called \u003Cstrong>JWT_AUTH_CORS_ENABLE\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cpre>\u003Ccode>define('JWT_AUTH_CORS_ENABLE', true);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>Namespace and Endpoints\u003C\u002Fh3>\n\u003Cp>When the plugin is activated, a new namespace is added.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002Fjwt-auth\u002Fv1\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Also, three new \u003Cem>POST\u003C\u002Fem> endpoints are added to this namespace.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\n\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u002Fvalidate\n\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u002Frefresh\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>Requesting\u002F Generating Token\u003C\u002Fh3>\n\u003Cpre>\u003Ccode>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>To generate token, submit a POST request to this endpoint. With \u003Ccode>username\u003C\u002Fcode> and \u003Ccode>password\u003C\u002Fcode> as the parameters.\u003C\u002Fp>\n\u003Cp>It will validates the user credentials, and returns success response including a token if the authentication is correct or returns an error response if the authentication is failed.\u003C\u002Fp>\n\u003Cp>You can use the optional parameter \u003Ccode>device\u003C\u002Fcode> with the device identifier to let user manage the device access in your profile. If this parameter is empty, it is ignored.\u003C\u002Fp>\n\u003Ch4>Sample of success response when trying to generate token:\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": true,\n    \"statusCode\": 200,\n    \"code\": \"jwt_auth_valid_credential\",\n    \"message\": \"Credential is valid\",\n    \"data\": {\n        \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczpcL1wvcG9pbnRzLmNvdXZlZS5jby5pZCIsImlhdCI6MTU4ODQ5OTE0OSwibmJmIjoxNTg4NDk5MTQ5LCJleHAiOjE1ODkxMDM5NDksImRhdGEiOnsidXNlciI6eyJpZCI6MX19fQ.w3pf5PslhviHohmiGF-JlPZV00XWE9c2MfvBK7Su9Fw\",\n        \"id\": 1,\n        \"email\": \"contactjavas@gmail.com\",\n        \"nicename\": \"contactjavas\",\n        \"firstName\": \"Bagus Javas\",\n        \"lastName\": \"Heruyanto\",\n        \"displayName\": \"contactjavas\"\n    }\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Sample of error response when trying to generate token:\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"invalid_username\",\n    \"message\": \"Unknown username. Try again or check your email address.\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Once you get the token, you must store it somewhere in your application. It can be:\u003Cbr \u002F>\n– using \u003Cstrong>cookie\u003C\u002Fstrong>\u003Cbr \u002F>\n– or using \u003Cstrong>localstorage\u003C\u002Fstrong>\u003Cbr \u002F>\n– or using a wrapper like \u003Ca href=\"https:\u002F\u002Flocalforage.github.io\u002FlocalForage\u002F\" rel=\"nofollow ugc\">localForage\u003C\u002Fa> or \u003Ca href=\"https:\u002F\u002Fpouchdb.com\u002F\" rel=\"nofollow ugc\">PouchDB\u003C\u002Fa>\u003Cbr \u002F>\n– or using local database like SQLite or \u003Ca href=\"https:\u002F\u002Fdocs.hivedb.dev\u002F#\u002F\" rel=\"nofollow ugc\">Hive\u003C\u002Fa>\u003Cbr \u002F>\n– or your choice based on app you develop 😉\u003C\u002Fp>\n\u003Cp>Then you should pass this token as \u003Cem>Bearer Authentication\u003C\u002Fem> header to every API call. The header format is:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>Authorization: Bearer your-generated-token\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>and here’s an example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\"Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczpcL1wvcG9pbnRzLmNvdXZlZS5jby5pZCIsImlhdCI6MTU4ODQ5OTE0OSwibmJmIjoxNTg4NDk5MTQ5LCJleHAiOjE1ODkxMDM5NDksImRhdGEiOnsidXNlciI6eyJpZCI6MX19fQ.w3pf5PslhviHohmiGF-JlPZV00XWE9c2MfvBK7Su9Fw\";\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>The \u003Cstrong>jwt-auth\u003C\u002Fstrong> will intercept every call to the server and will look for the authorization header, if the authorization header is present, it will try to decode the token and will set the user according with the data stored in it.\u003C\u002Fp>\n\u003Cp>If the token is valid, the API call flow will continue as always.\u003C\u002Fp>\n\u003Ch3>Validating Token\u003C\u002Fh3>\n\u003Cp>You likely \u003Cstrong>don’t need\u003C\u002Fstrong> to validate the token your self. The plugin handle it for you like explained above.\u003C\u002Fp>\n\u003Cp>But if you want to test or validate the token manually, then send a \u003Cstrong>POST\u003C\u002Fstrong> request to this endpoint (don’t forget to set your \u003Cem>Bearer Authorization\u003C\u002Fem> header):\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u002Fvalidate\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Valid Token Response:\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": true,\n    \"statusCode\": 200,\n    \"code\": \"jwt_auth_valid_token\",\n    \"message\": \"Token is valid\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>Refreshing the Access Token\u003C\u002Fh3>\n\u003Cp>For security reasons, third-party applications that are integrating with your authentication server will not store the user’s username and password. Instead they will store the refresh token in a user-specific storage that is only accessible for the user. The refresh token can be used to re-authenticate as the same user and generate a new access token.\u003C\u002Fp>\n\u003Cp>When authenticating with \u003Ccode>username\u003C\u002Fcode> and \u003Ccode>password\u003C\u002Fcode> as the parameters to \u003Ccode>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u003C\u002Fcode>, a refresh token is sent as a cookie in the response.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>To generate new access token using the refresh token, submit a POST request to the token endpoint together with the \u003Ccode>refresh_token\u003C\u002Fcode> cookie.\u003C\u002Fp>\n\u003Cp>Use the optional parameter \u003Ccode>device\u003C\u002Fcode> with the device identifier to associate the token with that device.\u003C\u002Fp>\n\u003Cp>If the refresh token is valid, then you receive a new access token in the response.\u003C\u002Fp>\n\u003Cp>By default, each access token expires after 10 minutes.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u002Frefresh\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>To generate new refresh token using the refresh token, submit a POST request to the token refresh endpoint together with the \u003Ccode>refresh_token\u003C\u002Fcode> cookie.\u003C\u002Fp>\n\u003Cp>Use the optional parameter \u003Ccode>device\u003C\u002Fcode> with the device identifier to associate the refresh token with that device.\u003C\u002Fp>\n\u003Cp>If the refresh token is valid, then you receive a new refresh token as a cookie in the response.\u003C\u002Fp>\n\u003Cp>By default, each refresh token expires after 30 days.\u003C\u002Fp>\n\u003Ch4>Refresh Token Rotation\u003C\u002Fh4>\n\u003Cp>Whenever you are authenticating afresh or refreshing the refresh token, only the last issued refresh token remains valid. All previously issued refresh tokens can no longer be used.\u003C\u002Fp>\n\u003Cp>This means that a refresh token cannot be shared. To allow multiple devices to authenticate in parallel without losing access after another device re-authenticated, use the parameter \u003Ccode>device\u003C\u002Fcode> with the device identifier to associate the refresh token only with that device.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>curl -F device=\"abc-def\" -F username=myuser -F password=mypass \u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\n\n\ncurl -F device=\"abc-def\" -b \"refresh_token=123.abcdef...\" \u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\n\n\ncurl -F device=\"abc-def\" -b \"refresh_token=123.abcdef...\" \u002Fwp-json\u002Fjwt-auth\u002Fv1\u002Ftoken\u002Frefresh\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>Errors\u003C\u002Fh3>\n\u003Cp>If the token is invalid an error will be returned. Here are some samples of errors:\u003C\u002Fp>\n\u003Ch4>No Secret Key\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"jwt_auth_bad_config\",\n    \"message\": \"JWT is not configured properly.\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>No HTTP_AUTHORIZATION Header\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"jwt_auth_no_auth_header\",\n    \"message\": \"Authorization header not found.\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Bad Iss\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"jwt_auth_bad_iss\",\n    \"message\": \"The iss do not match with this server.\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Invalid Signature\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"jwt_auth_invalid_token\",\n    \"message\": \"Signature verification failed\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Incomplete Payload\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"jwt_auth_bad_request\",\n    \"message\": \"User ID not found in the token.\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>User Not Found\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"jwt_auth_user_not_found\",\n    \"message\": \"User doesn't exist\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Expired Token\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"jwt_auth_invalid_token\",\n    \"message\": \"Expired token\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Obsolete Token\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 403,\n    \"code\": \"jwt_auth_obsolete_token\",\n    \"message\": \"Token is obsolete\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Invalid Refresh Token\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 401,\n    \"code\": \"jwt_auth_invalid_refresh_token\",\n    \"message\": \"Invalid refresh token\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Obsolete Refresh Token\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 401,\n    \"code\": \"jwt_auth_obsolete_refresh_token\",\n    \"message\": \"Refresh token is obsolete\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Expired Refresh Token\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>{\n    \"success\": false,\n    \"statusCode\": 401,\n    \"code\": \"jwt_auth_expired_refresh_token\",\n    \"message\": \"Refresh token has expired\",\n    \"data\": []\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>Available Filter Hooks\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>JWT Auth\u003C\u002Fstrong> is developer friendly and has some filters available to override the default settings.\u003C\u002Fp>\n\u003Ch4>jwt_auth_cors_allow_headers\u003C\u002Fh4>\n\u003Cp>The \u003Ccode>jwt_auth_cors_allow_headers\u003C\u002Fcode> allows you to modify the available headers when the CORs support is enabled.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>'X-Requested-With, Content-Type, Accept, Origin, Authorization'\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Change the allowed CORS headers.\n *\n * @param string $headers The allowed headers.\n * @return string The allowed headers.\n *\u002F\nadd_filter(\n    'jwt_auth_cors_allow_headers',\n    function ( $headers ) {\n        \u002F\u002F Modify the headers here.\n        return $headers;\n    }\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_iss\u003C\u002Fh4>\n\u003Cp>The \u003Cstrong>jwt_auth_iss\u003C\u002Fstrong> allows you to change the \u003Ca href=\"https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7519#section-4.1.1\" rel=\"nofollow ugc\">\u003Cstrong>iss\u003C\u002Fstrong>\u003C\u002Fa> value before the payload is encoded to be a token.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>get_bloginfo( 'url' )\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Change the token issuer.\n *\n * @param string $iss The token issuer.\n * @return string The token issuer.\n *\u002F\nadd_filter(\n    'jwt_auth_iss',\n    function ( $iss ) {\n        \u002F\u002F Modify the \"iss\" here.\n        return $iss;\n    }\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_not_before\u003C\u002Fh4>\n\u003Cp>The \u003Ccode>jwt_auth_not_before\u003C\u002Fcode> allows you to change the \u003Ca href=\"https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7519#section-4.1.5\" rel=\"nofollow ugc\">\u003Cstrong>nbf\u003C\u002Fstrong>\u003C\u002Fa> value before the payload is encoded to be a token.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F\u002F Creation time.\ntime()\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Change the token's nbf value.\n *\n * @param int $not_before The default \"nbf\" value in timestamp.\n * @param int $issued_at The \"iat\" value in timestamp.\n *\n * @return int The \"nbf\" value.\n *\u002F\nadd_filter(\n    'jwt_auth_not_before',\n    function ( $not_before, $issued_at ) {\n        \u002F\u002F Modify the \"not_before\" here.\n        return $not_before;\n    },\n    10,\n    2\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_expire\u003C\u002Fh4>\n\u003Cp>The \u003Ccode>jwt_auth_expire\u003C\u002Fcode> allows you to change the value \u003Ca href=\"https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7519#section-4.1.4\" rel=\"nofollow ugc\">\u003Cstrong>exp\u003C\u002Fstrong>\u003C\u002Fa> before the payload is encoded to be a token.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>time() + (DAY_IN_SECONDS * 7)\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Change the token's expire value.\n *\n * @param int $expire The default \"exp\" value in timestamp.\n * @param int $issued_at The \"iat\" value in timestamp.\n *\n * @return int The \"nbf\" value.\n *\u002F\nadd_filter(\n    'jwt_auth_expire',\n    function ( $expire, $issued_at ) {\n        \u002F\u002F Modify the \"expire\" here.\n        return $expire;\n    },\n    10,\n    2\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_refresh_expire\u003C\u002Fh4>\n\u003Cp>The \u003Ccode>jwt_auth_refresh_expire\u003C\u002Fcode> filter hook allows you to change the expiration date of the refresh token.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>time() + (DAY_IN_SECONDS * 30)\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Change the refresh token's expiration time.\n *\n * @param int $expire The default expiration timestamp.\n * @param int $issued_at The current time.\n *\n * @return int The custom refresh token expiration timestamp.\n *\u002F\nadd_filter(\n    'jwt_auth_refresh_expire',\n    function ( $expire, $issued_at ) {\n        \u002F\u002F Modify the \"expire\" here.\n        return $expire;\n    },\n    10,\n    2\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_alg\u003C\u002Fh4>\n\u003Cp>The \u003Ccode>jwt_auth_alg\u003C\u002Fcode> allows you to change the supported signing \u003Ca href=\"https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Fdraft-ietf-jose-json-web-algorithms-40\" rel=\"nofollow ugc\">algorithm\u003C\u002Fa> for your application.\u003C\u002Fp>\n\u003Cp>Default Value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>'HS256'\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Change the token's signing algorithm.\n *\n * @param string $alg The default supported signing algorithm.\n * @return string The supported signing algorithm.\n *\u002F\nadd_filter(\n    'jwt_auth_alg',\n    function ( $alg ) {\n        \u002F\u002F Change the signing algorithm here.\n        return $alg;\n    }\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_payload\u003C\u002Fh4>\n\u003Cp>The \u003Ccode>jwt_auth_payload\u003C\u002Fcode> allows you to modify all the payload \u002F token data before being encoded and signed.\u003C\u002Fp>\n\u003Cp>Default value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u003C?php\n$token = array(\n    'iss' => get_bloginfo('url'),\n    'iat' => $issued_at,\n    'nbf' => $not_before,\n    'exp' => $expire,\n    'data' => array(\n        'user' => array(\n            'id' => $user->ID,\n        )\n    )\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Modify the payload\u002F token's data before being encoded & signed.\n *\n * @param array $payload The default payload\n * @param WP_User $user The authenticated user.\n * .\n * @return array The payload\u002F token's data.\n *\u002F\nadd_filter(\n    'jwt_auth_payload',\n    function ( $payload, $user ) {\n        \u002F\u002F Modify the payload here.\n        return $payload;\n    },\n    10,\n    2\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>jwt_auth_valid_credential_response\u003C\u002Fh4>\n\u003Cp>The \u003Ccode>jwt_auth_valid_credential_response\u003C\u002Fcode> allows you to modify the valid credential response when generating a token.\u003C\u002Fp>\n\u003Cp>Default value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u003C?php\n$response = array(\n    'success'    => true,\n    'statusCode' => 200,\n    'code'       => 'jwt_auth_valid_credential',\n    'message'    => __( 'Credential is valid', 'jwt-auth' ),\n    'data'       => array(\n        'token'       => $token,\n        'id'          => $user->ID,\n        'email'       => $user->user_email,\n        'nicename'    => $user->user_nicename,\n        'firstName'   => $user->first_name,\n        'lastName'    => $user->last_name,\n        'displayName' => $user->display_name,\n    ),\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Modify the response of valid credential.\n *\n * @param array $response The default valid credential response.\n * @param WP_User $user The authenticated user.\n * .\n * @return array The valid credential response.\n *\u002F\nadd_filter(\n    'jwt_auth_valid_credential_response',\n    function ( $response, $user ) {\n        \u002F\u002F Modify the response here.\n        return $response;\n    },\n    10,\n    2\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>jwt_auth_valid_token_response\u003C\u002Fh3>\n\u003Cp>The \u003Cstrong>jwt_auth_valid_token_response\u003C\u002Fstrong> allows you to modify the valid token response when validating a token.\u003C\u002Fp>\n\u003Cp>Default value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u003C?php\n$response = array(\n    'success'    => true,\n    'statusCode' => 200,\n    'code'       => 'jwt_auth_valid_token',\n    'message'    => __( 'Token is valid', 'jwt-auth' ),\n    'data'       => array(),\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Modify the response of valid token.\n *\n * @param array $response The default valid token response.\n * @param WP_User $user The authenticated user.\n * @param string $token The raw token.\n * @param array $payload The token data.\n * .\n * @return array The valid token response.\n *\u002F\nadd_filter(\n    'jwt_auth_valid_token_response',\n    function ( $response, $user, $token, $payload ) {\n        \u002F\u002F Modify the response here.\n        return $response;\n    },\n    10,\n    4\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>jwt_auth_extra_token_check\u003C\u002Fh3>\n\u003Cp>The \u003Cstrong>jwt_auth_extra_token_check\u003C\u002Fstrong> allows you to add extra criterias to validate the token. If empty, has no problem to proceed. Use empty value to bypass the filter. Any other value will block the token access and returns response with code \u003Ccode>jwt_auth_obsolete_token\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cp>Default value:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>''\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Usage example:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>\u002F**\n * Modify the validation of token. No-empty values block token validation.\n *\n * @param array $response An empty value ''.\n * @param WP_User $user The authenticated user.\n * @param string $token The raw token.\n * @param array $payload The token data.\n * .\n * @return array The valid token response.\n *\u002F\nadd_filter(\n    'jwt_auth_extra_token_check',\n    function ( $response, $user, $token, $payload ) {\n        \u002F\u002F Modify the response here.\n        return $response;\n    },\n    10,\n    4\n);\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>Credits\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ffirebase\u002Fphp-jwt\" rel=\"nofollow ugc\">PHP-JWT from firebase\u003C\u002Fa>\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fjwt-authentication-for-wp-rest-api\u002F\" rel=\"ugc\">JWT Authentication for WP REST API\u003C\u002Fa>\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fpesseba\" rel=\"nofollow ugc\">Devices utility by pesseba\u003C\u002Fa>\u003Cbr \u002F>\nThe \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fusefulteam\u002Fjwt-auth\u002Fcollaborators\" rel=\"nofollow ugc\">awesome maintainers\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fusefulteam\u002Fjwt-auth\u002Fgraphs\u002Fcontributors\" rel=\"nofollow ugc\">contributors\u003C\u002Fa>\u003C\u002Fp>\n","Create JSON Web Token Authentication in WordPress.",6000,103837,100,22,"2024-05-07T21:38:00.000Z","6.5.8","5.2","7.2",[29,30,15,31],"json-web-token","jwt","token-authentication","https:\u002F\u002Fgithub.com\u002Fusefulteam\u002Fjwt-auth","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fjwt-auth.zip",90,1,0,"2022-11-11 00:00:00","2026-03-15T15:16:48.613Z",{"slug":40,"name":41,"version":42,"author":5,"author_profile":6,"description":43,"short_description":44,"active_installs":45,"downloaded":46,"rating":22,"num_ratings":47,"last_updated":48,"tested_up_to":49,"requires_at_least":26,"requires_php":27,"tags":50,"homepage":54,"download_link":55,"security_score":56,"vuln_count":36,"unpatched_count":36,"last_vuln_date":57,"fetched_at":38},"admin-ui","Custom Admin UI – WordPress Custom Admin UI or Custom Admin Theme","0.2.0","\u003Cp>WordPress is a very powerful CMS. It has huge ecosystem (plugins, themes, community). Can be used for almost any kind of website \u002F application.\u003C\u002Fp>\n\u003Cp>But the default admin area’s UI \u002F theme looks old. It can be improved. You might want to use this custom admin ui plugin to provide smoother and more beautiful UI for your WordPress admin area or dashboard.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Support & question: \u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Fadmin-ui\u002F\" rel=\"ugc\">WordPress support forum\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Reporting plugin’s bug: \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fusefulteam\u002Fadmin-ui\u002Fissues\" rel=\"nofollow ugc\">GitHub issues tracker\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdiscord.gg\u002FDgECpEg\" rel=\"nofollow ugc\">Discord channel\u003C\u002Fa> also available for faster response.\u003C\u002Fli>\n\u003C\u002Ful>\n","WordPress custom admin UI or admin theme. Turn your WordPress dashboard or admin area to be smoother and more beautiful.",300,3513,4,"2021-03-31T00:56:00.000Z","5.7.15",[51,52,53],"custom-admin-theme","custom-admin-ui","wordpress-admin-ui","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fadmin-ui\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fadmin-ui.zip",85,null]