API Reference

Authentication

Most endpoints require authentication using JWT tokens. To authenticate requests, include the token in the Authorization header:

Authorization: Bearer your-jwt-token

Base URL

The base URL for all API endpoints is your WordPress site’s REST API URL:

https://your-site.com/wp-json/jwt-auth/v1

Response Format

All responses are returned in JSON format. Successful responses include the requested data, while error responses follow this structure:

{
  "code": "error_code",
  "message": "Human readable error message",
  "data": {
    "status": 403
  }
}

Rate Limiting

API requests are subject to rate limiting based on your JWT Auth Pro settings. The current limits are:

Authentication attempts: 5 per minute per IP
Token validation: 60 per minute per token
Token refresh: 10 per minute per refresh token
Token revocation: 10 per minute per token

When rate limiting is enabled, the following headers are included in API responses:

X-RateLimit-Limit: 60        # Maximum requests allowed
X-RateLimit-Remaining: 45    # Remaining requests in current window
X-RateLimit-Reset: 1707411600    # Unix timestamp when the rate limit resets
Retry-After: 120             # Seconds to wait when rate limit is exceeded (only on 429 responses)

Rate Limit Exceeded

When you exceed the rate limit, you’ll receive a 429 (Too Many Requests) response:

{
  "code": "jwt_auth_rate_limited",
  "message": "Rate limit exceeded",
  "data": {
    "status": 429
  }
}

Rate limiting can be configured or disabled through the WordPress admin interface or using filters. See the Configuration and Filters documentation for more details.

Overview

Endpoints

Authentication

Base URL

Response Format

Rate Limiting

Rate Limit Exceeded

​Authentication

​Base URL

​Response Format

​Rate Limiting

​Rate Limit Exceeded

Authentication

Base URL

Response Format

Rate Limiting

Rate Limit Exceeded