REST API Guard

Anonymous requests to routes on the denylist are denied. All other routes are allowed. Use * as a wildcard.

add_filter( 'rest_api_guard_anonymous_requests_denylist', fn () => [ '/wp/v2/comments*', '/custom-namespace/v1/private/*', ] );

Require a JSON Web Token (JWT) for anonymous requests

Anonymous requests can be required to send a token in an Authorization: Bearer <token> header:

add_filter( 'rest_api_guard_authentication_jwt', '__return_true' );

Tokens are expected to have an audience of wordpress-rest-api and an issuer of the site URL. Both can be changed:

add_filter( 'rest_api_guard_jwt_audience', fn () => 'custom-audience' ); add_filter( 'rest_api_guard_jwt_issuer', fn () => 'https://example.com' );

Tokens are signed with a secret generated automatically and stored in the rest_api_guard_jwt_secret option. It can also be set in code:

add_filter( 'rest_api_guard_jwt_secret', fn () => 'my-custom-secret' );

Authenticate users with a JWT

Tokens can also be tied to a user. A request with a user token is treated as that user, with the same permissions they have:

add_filter( 'rest_api_guard_user_authentication_jwt', '__return_true' );

Generate, list, and revoke tokens

Once JWT authentication is enabled, tokens can be generated from the Tokens tab of the settings page. Give each one a name so you can tell them apart later, and optionally tie it to a user or set an expiration. The token is shown once after it’s generated, so copy it somewhere safe.

The same tab lists every token the plugin has issued, and any of them can be revoked. A revoked token stops working right away.

Tokens can also be managed with WP-CLI:

wp rest-api-guard generate-jwt [--name=<name>] [--user=<user-id>] [--expiration=<seconds>] wp rest-api-guard list-jwts wp rest-api-guard revoke-jwt <id>

Or generated in code:

$token = \Alley\WP\REST_API_Guard\generate_jwt( expiration: HOUR_IN_SECONDS, // Optional. Seconds until the token expires. user: 1, // Optional. A user ID or WP_User. name: 'Mobile App', // Optional. A name to identify the token by. );

Tokens issued before version 1.5.0 aren’t tracked, so they can’t be listed or revoked one at a time. They’re still accepted by default. To reject them:

add_filter( 'rest_api_guard_allow_untracked_jwt', '__return_false' );

Changing the rest_api_guard_jwt_secret option invalidates every token issued so far, tracked or not.

Caching

Responses to REST API requests that include an Authorization header are sent with no-cache headers so a page cache or CDN doesn’t store them.