How to set up JWT authentication with WPGraphQL in WordPress?

Install and activate both WPGraphQL and this plugin, define a secret key using GRAPHQL_JWT_AUTH_SECRET_KEY or a filter, and configure your server to pass HTTP_AUTHORIZATION headers. Then use the GraphQL mutations for login, registration, and token refresh.

WPGraphQL JWT authentication vs WP REST API JWT plugins?

This plugin is specifically for GraphQL endpoints via WPGraphQL, offering integrated mutations for a seamless experience. REST API JWT plugins work with WordPress's standard REST API, so choose based on your API architecture—GraphQL for flexible queries, REST for simplicity.

How to refresh JWT tokens in a React app with this plugin?

Store the refresh token from the login or register response and use the refreshJwtAuthToken mutation when the auth token expires. Implement error handling in your React app to detect 401 errors and automatically refresh tokens before retrying requests.

Is WPGraphQL JWT Authentication secure for production use?

Yes, it uses short-lived auth tokens by default (300 seconds) and provides refresh tokens, following security best practices. However, you must set a strong secret key and ensure server headers are correctly configured to prevent vulnerabilities.

How to enable HTTP_AUTHORIZATION in Apache for this plugin?

Add 'SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1' to your .htaccess file. For NGINX, you may need to update the server configuration to include 'proxy_set_header Authorization $http_authorization;' in location blocks.

Can I use this plugin with Next.js and a headless WordPress site?

Absolutely, it's designed for headless setups. Use the GraphQL mutations in your Next.js app to authenticate users, store tokens in local storage or cookies, and include the JWT in the Authorization header for protected queries.

Open-Awesome

WPGraphQL JWT Authentication

GPL-3.0PHPv0.7.2

Adds JWT-based authentication to WPGraphQL for WordPress, enabling secure user login and token management.

GitHub

362 stars79 forks0 contributors

What is WPGraphQL JWT Authentication?

WPGraphQL JWT Authentication is a WordPress plugin that adds JSON Web Token (JWT) authentication to WPGraphQL. It enables secure user login, registration, and token refresh via GraphQL mutations, allowing headless WordPress setups to implement stateless authentication for modern frontends. The plugin solves the need for token-based auth in decoupled WordPress architectures.

Target Audience

WordPress developers building headless or decoupled sites with WPGraphQL, especially those using React, Vue, or other JavaScript frameworks that require secure API authentication.

Value Proposition

Developers choose this plugin because it seamlessly integrates JWT authentication into WPGraphQL's schema, offering a standardized, secure alternative to WordPress cookies for headless setups. Its simplicity, extensibility via filters, and focus on short-lived tokens make it a robust solution for modern authentication workflows.

Overview

Authentication for WPGraphQL using JWT (JSON Web Tokens)

Use Cases

Best For

Adding JWT authentication to headless WordPress sites using WPGraphQL
Securing GraphQL API endpoints for user-specific data in decoupled architectures
Implementing token-based login and registration in React or Vue apps with WordPress backends
Replacing cookie-based sessions with stateless JWT tokens in WordPress
Managing user authentication in mobile apps connected to WordPress via GraphQL
Extending WPGraphQL with custom authentication logic via filters

Not Ideal For

Traditional WordPress sites using server-side themes with cookie-based sessions
Projects relying on REST API instead of GraphQL for authentication
Environments where server configuration for HTTP_AUTHORIZATION headers is restricted, such as shared hosting without .htaccess access
Teams seeking a managed auth service with built-in UI or social login options

Pros & Cons

Pros

Industry-Standard JWT

Implements RFC 7519 for secure token-based authentication, ensuring compatibility with modern security practices and tools like JWT.io.

Seamless GraphQL Integration

Adds login, register, and refresh token mutations directly to the WPGraphQL schema, simplifying client-side implementation with examples for Apollo and Relay.

Customizable Security Policies

Offers filters like graphql_jwt_auth_expire to adjust token expiration times, allowing tailored security without modifying core code.

WordPress Standards Compliance

Built following WordPress coding standards and extensible via hooks, ensuring easy integration with other plugins and themes.

Cons

Server Configuration Hurdle

Requires enabling HTTP_AUTHORIZATION headers in Apache or NGINX, which can be complex and error-prone, especially in shared hosting environments.

Dependency on WPGraphQL

Only functions if WPGraphQL is installed and active, adding an extra layer of maintenance and potential compatibility issues.

Limited Frontend Support

Provides no built-in UI or frontend components, requiring developers to manually handle token storage and HTTP headers in their applications.

Frequently Asked Questions

Related Projects

WPGraphQL for WooCommerce

Add WooCommerce support and functionality to your WPGraphQL server

Stars704

Forks146

Last commit19 days ago

WPGraphQL for Advanced Custom Fields

Stars618

Forks114

Last commit1 year ago

WPGraphQL Gutenberg

Query gutenberg blocks with wp-graphql

Stars305

Forks60