WordPress Salt Generator<\/a><\/p>\n\nCORS Support<\/h3>\n\n
Cross-Origin Resource Sharing (CORS) is enabled by default to allow frontend applications to connect. To disable or customize it via constant:<\/p>\n\n
define('headlesskey_CORS', true); \/\/ or false to disable\n<\/code><\/pre>\n\nREST API Namespace<\/h3>\n\n
By default, endpoints are under wp-json\/wpauthapi\/v1<\/code>. You can customize this namespace:<\/p>\n\ndefine('headlesskey_REST_NAMESPACE', 'my-custom-auth');\ndefine('headlesskey_REST_VERSION', 'v2');<h3>Endpoints<\/h3>\n<\/code><\/pre>\n\nThe plugin adds the following endpoints under the \/wp-json\/headlesskey\/v1<\/code> namespace:<\/p>\n\n\n\n\n Endpoint\n HTTP Verb\n Description\n\n\n\n\n \/token<\/code>\n POST\n Login<\/strong>: Exchange username\/password for a JWT.\n\n\n \/token\/validate<\/code>\n POST\n Validate<\/strong>: Check if a token validity.\n\n\n \/token\/refresh<\/code>\n POST\n Refresh<\/strong>: Exchange a valid token for a new one (rotation).\n\n\n \/token\/revoke<\/code>\n POST\n Logout<\/strong>: Invalidate a specific token.\n\n\n \/register<\/code>\n POST\n Register<\/strong>: Create a new user account.\n\n\n \/login<\/code>\n POST\n Profile<\/strong>: Login and get full user profile data in one request.\n\n\n \/forgot-password<\/code>\n POST\n Recover<\/strong>: Request a password reset via Link or OTP.\n\n\n \/reset-password<\/code>\n POST\n Reset<\/strong>: Set a new password using a token or OTP.\n\n\n \/change-password<\/code>\n POST\n Update<\/strong>: Change password for authenticated user.\n\n\n \/sso\/exchange<\/code>\n POST\n SSO<\/strong>: Exchange a remote site token for a local session.\n\n\n\n\n1. Login (Generate Token)<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/token<\/code>\nDescription:<\/strong> Authenticate a user and generate a JWT token.<\/p>\n\nRequest:<\/strong>\n json\n{\n \"username\": \"admin\",\n \"password\": \"secret-password\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...\",\n \"expiration\": \"2023-10-27T10:00:00+00:00\",\n \"expires_in\": 3600,\n \"user\": {\n \"ID\": 1,\n \"user_login\": \"admin\",\n \"user_email\": \"admin@example.com\",\n \"display_name\": \"Administrator\",\n \"roles\": [\"administrator\"]\n },\n \"refreshable\": true,\n \"jti\": \"545086b9-450f-488b-a70d-3047d14d1101\"\n}<\/code><\/p>\n\n2. Validate Token<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/token\/validate<\/code>\nDescription:<\/strong> Validate if an existing token is valid.<\/p>\n\nRequest:<\/strong>\n json\n{\n \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"valid\": true,\n \"data\": {\n \"iss\": \"https:\/\/example.com\",\n \"iat\": 1698393600,\n \"exp\": 1698397200,\n \"data\": {\n \"ID\": 1,\n \"user_login\": \"admin\"\n }\n }\n}<\/code><\/p>\n\n3. Refresh Token<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/token\/refresh<\/code>\nDescription:<\/strong> Rotate an expiring token for a fresh one.<\/p>\n\nRequest:<\/strong>\n json\n{\n \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.new...\",\n \"expiration\": \"2023-10-27T11:00:00+00:00\",\n \"user\": {\n \"ID\": 1,\n \"user_login\": \"admin\"\n },\n \"jti\": \"new-uuid-v4\"\n}<\/code><\/p>\n\n4. Revoke Token (Logout)<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/token\/revoke<\/code>\nDescription:<\/strong> Invalidate a token immediately.<\/p>\n\nRequest:<\/strong>\n json\n{\n \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"message\": \"Token revoked successfully.\"\n}<\/code><\/p>\n\n5. Register User<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/register<\/code>\nDescription:<\/strong> Create a new user account.<\/p>\n\nRequest:<\/strong>\n json\n{\n \"username\": \"johndoe\",\n \"email\": \"john@example.com\",\n \"password\": \"secure-password\",\n \"name\": \"John Doe\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"user_id\": 45,\n \"user\": {\n \"ID\": 45,\n \"user_login\": \"johndoe\",\n \"user_email\": \"john@example.com\",\n \"display_name\": \"John Doe\",\n \"roles\": [\"subscriber\"]\n },\n \"token_response\": {\n \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOi...\",\n \"expiration\": \"2023-10-27T10:00:00+00:00\"\n }\n}<\/code><\/p>\n\n6. User Profile (Login Extended)<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/login<\/code>\nDescription:<\/strong> Alternative login endpoint that returns cleaner profile structure.<\/p>\n\nRequest:<\/strong>\n json\n{\n \"username\": \"admin\",\n \"password\": \"secret-password\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...\",\n \"expiration\": \"2023-10-27T10:00:00+00:00\",\n \"user\": {\n \"ID\": 1,\n \"user_login\": \"admin\",\n \"user_email\": \"admin@example.com\",\n \"display_name\": \"Administrator\",\n \"roles\": [\"administrator\"]\n }\n}<\/code><\/p>\n\n7. Forgot Password<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/forgot-password<\/code>\nDescription:<\/strong> Initiate password recovery. Note: delivery<\/code> can be link<\/code> or otp<\/code>.<\/p>\n\nRequest:<\/strong>\n json\n{\n \"login\": \"admin@example.com\",\n \"delivery\": \"link\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"message\": \"Password reset email sent.\"\n}<\/code><\/p>\n\n8. Reset Password<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/reset-password<\/code>\nDescription:<\/strong> Reset password using the token sent via email or OTP.<\/p>\n\nRequest (Link method):<\/strong>\n json\n{\n \"login\": \"admin@example.com\",\n \"password\": \"new-secure-password\",\n \"token\": \"generated-reset-key\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"message\": \"Password updated successfully.\"\n}<\/code><\/p>\n\n9. Change Password<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/change-password<\/code>\nDescription:<\/strong> Change password for currently authenticated user. Requires Authorization<\/code> header.<\/p>\n\nHeaders:<\/strong>\n Authorization: Bearer <\/p>\n\nRequest:<\/strong>\n json\n{\n \"current_password\": \"old-password\",\n \"new_password\": \"new-secure-password\"\n}<\/code><\/p>\n\nResponse:<\/strong>\n json\n{\n \"message\": \"Password changed successfully. Please login again.\"\n}<\/code><\/p>\n\n10. SSO Token Exchange<\/h3>\n\n
Endpoint:<\/strong> POST \/wp-json\/headlesskey\/v1\/sso\/exchange<\/code>\nDescription:<\/strong> Securely exchange a token from a connected remote site for a local authentication session. This powers the distributed Single Sign-On network.<\/p>\n\nRequest:<\/strong>\n json\n{\n \"site_key\": \"remote-site-id\",\n \"token\": \"remote-jwt-token\",\n \"signature\": \"hmac-sha256-signature\"\n}<\/code><\/p>\n\nResponse:<\/strong>\nReturns a standard Login<\/strong> response (Token + User Data) if the signature is valid.<\/p>\n\n\n\nHow do I generate a JWT Secret?<\/h3><\/dt>\nThe plugin automatically generates a strong secret key upon activation. You can find it in the plugin settings. For better security, you can define headlesskey_SECRET_KEY<\/code> in your wp-config.php<\/code> file.<\/p><\/dd>\nCan I use this with Next.js or other frontend frameworks?<\/h3><\/dt>\nYes! The plugin sends correct CORS headers and returns standard JSON responses, making it compatible with any frontend framework or language that supports HTTP requests.<\/p><\/dd>\n
Does it support Public\/Private keys?<\/h3><\/dt>\nYes, you can configure RS256 or ES256 algorithms in the settings and provide your PEM formatted keys for asymmetric signing.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.0<\/h4>\n\n\n- Initial Release<\/strong>: Complete authentication suite with JWT, RBAC, SSO, and Security features.<\/li>\n
- Security<\/strong>: Added Brute Force protection, Device Limits, and Security Webhooks.<\/li>\n
- API<\/strong>: Full set of endpoints for Login, Register, Password Reset, and Token Management.<\/li>\n<\/ul>","raw_excerpt":"A complete authentication solution for Headless WordPress applications using JWT, supporting Registration, SSO, RBAC, and advanced Security features.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/267231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=267231"}],"author":[{"embeddable":true,"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/hidayatsafewp"}],"wp:attachment":[{"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=267231"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=267231"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=267231"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=267231"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=267231"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/dv.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=267231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}