🔓 Free · WordPress.org ⚡ Pro · parorrey.com

Turn WordPress into a secure backend for your app.

Connect mobile apps, web frontends, and AI-built products to WordPress without creating a custom API from scratch. Start free with content access and JWT user authentication; add Pro when your app needs to publish structured content and operate reliably in production.

Use the WordPress content models you already know—posts, custom post types, taxonomies, media, users, and custom fields—through predictable JSON endpoints that work with any client capable of HTTPS requests.

Start freePro when your app grows
JWT + HTTPSSecure user authentication
CPT + custom fieldsKeep your content model
No required SDKUse any HTTP client
GET /api/posts/get_recent_posts/?count=3
{
  "status": "ok",
  "count": 3, // posts returned
  "posts": [{
    "id": 48,
    "title": "Hello world",
    "url": "https://yoursite.com/hello/",
    "author": { "slug": "admin" },
    "comments": [ … ]
  }]
}
RESTful JSON API — Expose. Connect. Empower. Your WordPress Data Everywhere.
Read
Deliver WordPress content anywhere
Login
Authenticate app users with JWT
Publish
Manage CPT content with Pro
Protect
Cache, limit, log, and manage
A practical WordPress backend

Build the product you want without rebuilding WordPress.

Your content, users, media, and editorial workflow stay in WordPress. RESTful JSON API provides the connection your mobile app, web frontend, or AI-assisted build needs.

📱

Mobile apps

Give iOS, Android, Flutter, or React Native apps a consistent way to load content, authenticate users, manage profiles, and submit protected content.

🧩

Structured-content apps

Power directories, courses, events, listings, products, recipes, jobs, properties, and other products built around custom post types and taxonomies.

🌐

Headless websites

Use WordPress as the editorial system behind a separate frontend while keeping content discovery, media, menus, search, users, and permissions in one place.

🤖

AI-assisted builds

Claude, Codex, Gemini, Copilot, Grok, and other coding tools can follow discoverable controller and endpoint patterns instead of inventing a custom integration.

Keep your existing workflow. Editors continue working in WordPress while your app reads and, with Pro, writes the same structured content through the API.
Choose the right starting point

Start with the Free RESTful JSON API Plugin. Upgrade when the app must write and scale.

The free plugin is a capable foundation for content delivery and user flows. Pro is for products that need protected content management, stronger operational controls, and commercial support.

Free: connect, read, authenticate, and validate your idea
🔐

JWT bearer authentication

Cookie auth is gone. Apps log in with user/login, receive a plugin-issued JWT, and send Authorization: Bearer ACCESS_TOKEN on protected endpoints.

Five modular controllers

Core, Posts, Respond, Widgets, User — 40 free endpoints and 54 with the expanded Pro Posts controller. Only Core is on by default; activate others in one click.

🧩

CPT and taxonomy discovery

Mobile and web apps can discover public post types, taxonomies, terms, media, attachments, and comments before rendering custom app screens.

🔑

Optional API key

Require a shared secret on every request. Off by default, opt-in when needed — also accepts an X-JSON-API-KEY header.

🌐

CORS support

Per-origin CORS headers so browser-based JS on a different domain can call your API. Off by default, never a wildcard *.

🔒

Require HTTPS setting

API Config includes a Require HTTPS checkbox, enabled by default, with a clear warning before site owners disable SSL protection for password or bearer-token requests.

🪝

Six extension hooks

Build custom caching, throttling, or logging without touching core code. Pro and 3rd-party plugins hook these directly.

Settings link on plugin row

A Settings link appears on both the free and Pro plugin rows — instant access without hunting through admin menus.

📚

Documentation tab

Full endpoint documentation now lives inside the plugin settings, with controller groups and sample code for login, token validation, post writes, user meta, comments, and more.

Pro: publish structured content and run with confidence
✍️

Expanded Posts controller

JWT-protected content management for apps and agents.

  • Create, update, and delete posts or CPT entries
  • Create, update, delete, and assign taxonomy terms
  • Read, set, and delete post meta
  • Upload, sideload, or reuse featured media
⏱️

Caching

Anonymous GET responses cached as WP transients.

  • 1 hr to 72 hrs, or off
  • Per-endpoint exclude list by controller
  • Param-aware cache keys
  • Auth & nonce endpoints never cached
🚦

Rate Limiting

Token-bucket throttling — no fixed-window boundary burst.

  • Limit by IP, the site's shared API key, or globally
  • Fires before controller validation
  • Clean 429 + Retry-After header
📋

Audit Logging

Opt-in trail for write-style calls.

  • Records time, endpoint, user, object ID, IP
  • Never stores request body or payload
  • Filterable log viewer with clear-all
🗃️

Manage Transients

A real WP_List_Table screen over cached responses.

  • Filter by endpoint, sort by age
  • Row-level or bulk delete
  • One-click "Delete All Transients"
How it works

Connect your app in three straightforward steps.

Install the plugin, enable only the controllers your project needs, then call plain HTTPS endpoints from your preferred app framework. No vendor SDK is required.

cURL JavaScript (fetch) PHP (wp_remote_*)
# Step 1 — Get recent posts (Posts controller)
curl "https://yoursite.com/api/posts/get_recent_posts/?count=5"

# Step 2 — Get a JWT bearer token (User controller must be active)
curl -X POST "https://yoursite.com/api/user/login/" \
  -d "username=editor&password=YOUR_PASSWORD"

# Step 3 — Create a CPT post with taxonomy, ACF-style meta, and an image URL
curl -X POST "https://yoursite.com/api/posts/create_post/" \
  -H "Authorization: Bearer ACCESS_TOKEN_FROM_STEP_2" \
  -d "post_type=property" \
  -d "title=Downtown Apartment" \
  -d "status=publish" \
  -d "taxonomies[property_city]=Lahore" \
  -d "meta[price]=250000" \
  -d "image_url=https://example.com/property.jpg" \
  -d "set_featured_image=1"
// Step 1 — Get recent posts
const res  = await fetch("https://yoursite.com/api/posts/get_recent_posts/?count=5");
const data = await res.json();

// Step 2 — Obtain a JWT bearer token
const auth = await fetch("https://yoursite.com/api/user/login/", {
  method: "POST",
  body: new URLSearchParams({ username: "editor", password: "YOUR_PASSWORD" })
}).then(r => r.json());

// Step 3 — Create a CPT post with app fields
await fetch("https://yoursite.com/api/posts/create_post/", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${auth.token}`,
    "Content-Type": "application/x-www-form-urlencoded"
  },
  body: new URLSearchParams({
    post_type: "property",
    title: "Downtown Apartment",
    status: "publish",
    "taxonomies[property_city]": "Lahore",
    "meta[price]": "250000",
    image_url: "https://example.com/property.jpg",
    set_featured_image: "1"
  })
});
// Step 1 — Get recent posts
$r     = wp_remote_get( 'https://yoursite.com/api/posts/get_recent_posts/?count=5' );
$posts = json_decode( wp_remote_retrieve_body( $r ) )->posts;

// Step 2 — Obtain a JWT bearer token
$auth   = json_decode( wp_remote_retrieve_body( wp_remote_post(
  'https://yoursite.com/api/user/login/',
  [ 'body' => [ 'username' => 'editor', 'password' => 'YOUR_PASSWORD' ] ]
) ) );
$token = $auth->token;

// Step 3 — Create a CPT post with app fields
wp_remote_post( 'https://yoursite.com/api/posts/create_post/', [
  'headers' => [ 'Authorization' => 'Bearer ' . $token ],
  'body' => [
    'post_type' => 'property',
    'title'     => 'Downtown Apartment',
    'status'    => 'publish',
    'taxonomies' => [ 'property_city' => 'Lahore' ],
    'meta'      => [ 'price' => '250000' ],
    'image_url' => 'https://example.com/property.jpg',
    'set_featured_image' => '1',
  ],
] );

💡 The token from user/login is a plugin-issued JWT. Send it as Authorization: Bearer ACCESS_TOKEN on protected endpoints. Cookie auth and Application Passwords are not used. CPT and ACF-style app fields use post_type, taxonomies[...], and meta[...].

Lower-risk adoption

Fit the API into your stack—not your stack into the API.

The plugin uses familiar WordPress concepts and standard HTTPS requests, so teams can evaluate it quickly and keep their existing app framework, hosting, and editorial workflow.

🔌

Works with your framework

Use Flutter, native iOS or Android, React Native, JavaScript, PHP, or any client that can make HTTPS requests and parse JSON.

🧭

Discoverable and documented

Focused controllers, predictable endpoint patterns, and documentation inside WordPress help both developers and AI coding tools follow the integration.

📈

Upgrade without rebuilding

Start with the free plugin, preserve the same read paths, and add Pro's write operations and production controls when the product requires them.

Pricing

Get every Pro feature. Choose the license that fits.

Every paid tier includes the same expanded Posts controller and production controls. Choose by site count, support level, and bundled custom-development time.

Pro

Single site or client project

$110one-time

Single domain · 1 year updates & support

  • Expanded Posts controller with protected content, taxonomy, and post-meta writes
  • Caching, Rate Limiting, Logging, Manage Transients
  • License activation tab in free plugin settings
  • Basic email support
  • 1 year of plugin updates
  • Renew after year one — optional
Secure PayPal checkout
Most popular

Business

Agencies with a handful of clients

$255one-time

4 domains · 1 year updates & priority support

  • Everything in Pro
  • Priority email support
  • 2 hours custom endpoint development
  • License covers up to 4 client installs
Secure PayPal checkout

Developer

Agencies & product builders

$399one-time

Up to 8 domains · 2 years updates & support

  • Everything in Business
  • License covers up to 8 domains — ideal for agencies
  • Priority support + 30-min onboarding call
Secure PayPal checkout
Compare plans

See exactly when Pro becomes the right choice.

All paid tiers run the identical Pro plugin — what differs is site count, support level, and bundled dev hours.

Freewordpress.org Pro$110 · 1 domain Business$255 · 4 domains Developer$399 · 8 domains
Free REST endpoints (40)
Pro post write endpoints
CPT create/update/delete with post_type
ACF-style custom fields via post meta
Image uploads, image URLs, base64 images
JWT bearer authentication
Optional API key auth
CORS allowed-origins
Require HTTPS auth setting
Documentation tab with endpoint samples
Top-level admin menu
Settings link on plugin row
Six developer extension hooks
Caching (transients, per-endpoint)
Token-bucket Rate Limiting
Audit Logging
Manage Transients screen
License activation & management
Support levelCommunity (wp.org)Basic emailPriority emailPriority + onboarding call
Updates includedOngoing1 year1 year2 years
Operate with confidence

Production controls you can manage from WordPress.

Improve repeat-read performance, slow abusive traffic, review important write activity, and refresh API caches without building separate infrastructure.

⏱️

Response Caching

Successful anonymous GET responses are cached as WordPress transients, avoiding repeated controller and content-query work on cache hits. Duration: 1 hr to 72 hrs. Cache keys are parameter-aware so ?page=1 and ?page=2 never collide. Auth and nonce endpoints are excluded automatically.

🚦

Token-Bucket Rate Limiting

Fires at early_dispatch, before controller validation and endpoint-specific database work. The token bucket refills continuously: normal bursts are absorbed while sustained abuse is capped. Rejected requests receive 429 with a Retry-After header.

📋

Audit Log

Records selected write-style API calls without storing payload bodies, passwords, JWT tokens, or submitted content. Useful for seeing who created, updated, deleted, registered, or changed user meta.

🗃️

Manage Transients

A real WP_List_Table over all cached responses. Filter by endpoint, sort by age, delete a single row or bulk-clear. One button to purge all API transients at once — useful after a content import or theme change.

Caching

Cache anonymous read endpoints without touching authenticated traffic.

Caching is built for public content reads such as posts, pages, taxonomies, menus, search, and archive indexes. It stores successful anonymous responses as WordPress transients and skips sensitive endpoints automatically.

  • Turn caching off, or choose a duration from 1 hour through 72 hours.
  • Cache keys include endpoint plus normalized request parameters.
  • Authenticated, JWT, nonce, login, signup, and write-style endpoints stay uncached.
  • Works with the moved Posts controller paths such as posts/get_recent_posts.
  • Stores only the final response payload in WordPress transients.
Caching
Enable caching Cache anonymous GET responses
Cache duration
Never cacheuser/login, user/validate_token, core/get_nonce
Cache keyController + method + sorted query args

Rate Limiting

Stop abusive API bursts before controller code runs.

Rate Limiting runs early in dispatch, before expensive controller work. The token-bucket model permits normal bursts but caps sustained abuse with a predictable API response.

  • Limit by client IP, the site's configured shared API key, or one global site-wide bucket.
  • Set max burst capacity and sustained refill rate.
  • Runs before database-heavy endpoint logic is reached.
  • Returns HTTP 429 plus Retry-After for clients that should back off.
  • Avoids fixed-window boundary bursts that can double traffic in seconds.
Rate Limiting
Limit scope
Max burst requests
Refill rate requests / minute
Bucket health

Log

Audit important API activity without storing private payloads.

The Log tab is for operational visibility. It records the facts needed to trace API activity while deliberately avoiding request bodies and sensitive values.

  • Enable or disable audit logging from its own tab.
  • Choose which endpoints should be logged.
  • Default focus is write-style endpoints like post writes, signup, and user meta changes.
  • Records timestamp, endpoint, user ID, detectable object ID, and IP address.
  • Never stores passwords, JWT tokens, raw request bodies, or submitted post content.
Log
TimeEndpointUserObject ID
09:42posts/create_post#12#248
09:39user/set_meta#12
09:34posts/delete_post#4#241
09:31user/signupguest#18

Manage Transients

Inspect and clear cached API responses from wp-admin.

Manage Transients turns the hidden cache layer into a visible admin workflow. Site owners can inspect cached endpoint rows and clear only what needs to be refreshed.

  • List RESTful JSON API cache transients in a WordPress admin table.
  • Filter rows by endpoint name and sort by age or expiration.
  • Delete one cached response, selected rows, or all API transients.
  • Useful after imports, migrations, taxonomy edits, or menu changes.
  • Designed for API-specific cache cleanup without touching unrelated site transients.
Manage Transients
EndpointAgeExpires
posts/get_recent_posts12 min23h 48m
core/get_menu31 min23h 29m
posts/get_category_posts1h 08m22h 52m
Delete selectedDelete all API transients

Token buckets vs. fixed windows — why it matters

✓ Token bucket (what Pro uses)

The bucket refills at a continuous rate. A client can burst up to the max capacity then is smoothed to the sustained rate. No exploit at any boundary.

✗ Fixed window (what most plugins use)

A client fires 60 requests at 12:00:59 and 60 more at 12:01:00 — 120 requests in under 2 seconds, technically within the rules. Token bucket closes this exploit entirely.

Why teams upgrade to Pro

Move from content access to a production app backend.

Pro lets authenticated app users and services manage CPT content, taxonomy terms, custom fields, and images. It also gives site owners practical controls for performance, abuse prevention, activity visibility, and cache cleanup.

License Activation

RESTful JSON API Pro License Not Activated

Enter your license key to unlock the expanded Posts controller, Caching, Rate Limiting, Log, and Manage Transients. All license types activate the same plugin features.

Activate LicenseGet a license →
RESTful JSON API Pro License Active
Deactivate License

Activated on: yoursite.com · License type: Business · Expires: 2027-07-01

How licensing works

  • Pro announces itself at filter priority 1 (always "installed")
  • Licensing class hooks at priority 10 with the real active/inactive state
  • Unlicensed install shows the "Upgrade" mock-up tabs again — not an error
  • Deactivate on one site to activate on another within your seat count

Pro settings screen

/wp-admin/admin.php?page=restful-json-api#tab-caching
API ConfigControllersCachingRate LimitingLogLicense
License Active

yoursite.com · Business

Cache duration
Exclude endpoint
user/login

The License box appears at the top of every Pro tab — reachable wherever you are in settings. Pro's settings expand with each new feature release.

Technical reference

Expose only the API capabilities your project needs.

For implementation teams, the API is divided into five focused controllers. Core is enabled by default; activate the others from RESTful JSON API → Settings → Controllers.

Core
11 endpoints
Active by default
Posts
14 free · 28 with Pro
Off by default
User
13 endpoints
Off by default
Respond
1 endpoint
Off by default
Widgets
1 endpoint
Off by default

Core controller Active by default · Read-only

API metadata, pages, search, archive indexes, taxonomy indexes, authors, menus, and nonce helper methods. Post read endpoints now live in the Posts controller.

infoget_pageget_search_resultsget_date_indexget_category_indexget_tag_indexget_author_indexget_page_indexget_menuget_list_menuget_nonce

Posts controller

⭐ Read in free · Write in Pro

Free includes post, CPT, taxonomy, media, attachment, and comment read endpoints. Pro expands that controller with JWT-protected post and CPT writes, taxonomy term management and assignment, plus post-meta operations. Use CPTs for products, listings, courses, events, directories, or any app-specific content model; use post meta for ACF-style fields.

get_recent_postsget_postsget_postget_date_postsget_category_postsget_tag_postsget_author_postsget_post_typesget_taxonomiesget_termsget_taxonomy_postsget_mediaget_post_attachmentsget_post_comments
PRO get_categoriesPRO get_tagsPRO get_termPRO get_post_termsPRO set_post_termsPRO create_termPRO update_termPRO delete_termPRO create_postPRO update_postPRO delete_postPRO get_post_metaPRO set_post_metaPRO delete_post_meta
PRO create_post
Creates a post, page, or CPT entry. Supports custom taxonomy terms, post meta for ACF-style fields, attachment, featured_image, image_url, base64 image_data, and existing featured_media.
Required
  • Authorization: Bearer ACCESS_TOKEN
  • Account needs edit_posts capability
Optional
  • post_type, status, title, content
  • taxonomies[product_cat], categories, tags
  • meta[acf_field_name], attachment, featured_image, image_url, image_data
PRO update_post
Updates an existing post by ID or slug. Only fields you send are changed.
Required
  • Authorization: Bearer ACCESS_TOKEN for a user that can edit this post
  • id / post_id or slug / post_slug
Optional
  • Same fields as create_post
PRO delete_post
Permanently deletes a post by ID or slug.
Required
  • Authorization: Bearer ACCESS_TOKEN
  • Requires edit_post, delete_posts, and delete_other_posts when deleting another user's post
  • id / post_id or slug / post_slug
JWT auth, on purpose. Protected Pro write operations authenticate with a plugin-issued Authorization: Bearer ACCESS_TOKEN header from user/login. Cookie auth, browser sessions, Application Passwords, and nonce-based write auth are not required for mobile apps or server clients.

User controller

⭐ Spotlight — Auth & Accounts

A rebuilt User controller for signup, JWT login, token validation, profiles, avatars, safe user meta, password reset requests, and authenticated comments. Legacy cookie, Facebook, and BuddyPress xProfile endpoints have been removed.

login
Validates username/email + password and returns a JWT bearer token with expiry metadata.
Required
  • username, password · HTTPS required by default
Optional
  • seconds — token lifetime
validate_token
Checks the current JWT and returns the authenticated user. Invalid or expired tokens return a 401 telling clients to log in again.
Required
  • Authorization: Bearer ACCESS_TOKEN
signup
Creates a new WordPress account and returns a JWT for the new user.
Required
  • username, email
Optional
  • password, display_name, first_name, last_name, custom_fields
me
Returns the authenticated user's private profile without exposing raw capability arrays.
Required
  • Authorization: Bearer ACCESS_TOKEN
profile · avatar
Returns public profile data and avatar URLs by user ID, username, or the current JWT user.
Optional
  • user_id, username, size, avatar_size
meta · set_meta · delete_meta · set_meta_many
Read, write, delete, or bulk-set safe custom meta for the authenticated user. Protected internal keys are blocked.
Required
  • Authorization: Bearer ACCESS_TOKEN
  • key / value or custom_fields
request_password_reset
Triggers WordPress password reset email with a non-enumerating response.
Required
  • account — username or email address
create_comment · info
Create an authenticated comment as the current JWT user, or inspect User controller metadata.
Required
  • Authorization: Bearer ACCESS_TOKEN for comments
  • post_id, content

Respond controller

Accepts comments from decoupled front ends without a browser session.

submit_comment

Widgets controller

Returns rendered HTML for any registered sidebar — handy for mirroring footers inside an app shell.

get_sidebar
Simple WordPress administration

Configure the API without editing code.

Use a dedicated WordPress admin area to choose controllers, enforce HTTPS, configure a shared API key and browser origins, read endpoint documentation, manage Pro controls, and find support.

Admin menu structure

Companion plugins hook restful_json_api_admin_menu to add their submenu item — no separate top-level entries scattered through wp-admin.

Plugin page Settings links

Installed Plugins
RESTful JSON API
Settings|Deactivate
RESTful JSON API Pro
Settings|Deactivate

API Config tab — all settings

/wp-admin/admin.php?page=restful-json-api
API ConfigControllers CachingRate Limiting LogManage Transients LicenseDocumentationSupport
API Base

URL segment for pretty permalink requests. With api set, calls look like yoursite.com/api/posts/get_recent_posts/. Leave blank for ?json= query variable fallback.

yoursite.com/
API Key

Optional, blank by default. When set, every request must include this as a key param or X-JSON-API-KEY header — rejected with a 401 if missing.

Generate new key
CORS Configurable

Comma-separated list of origins permitted to call this API from browser JavaScript (e.g. https://app.example.com). Leave blank to send no CORS headers. Matched origin is reflected back specifically — never a literal wildcard *. CORS is a browser-only mechanism and doesn't affect mobile apps or server calls.

Require HTTPS Default on

Blocks password and JWT bearer-token requests unless the request is HTTPS. Site owners can uncheck it for local or non-SSL environments, but the field includes a warning because production sites should keep it enabled.

A familiar upgrade path

Preview Pro controls before you buy.

The free plugin shows accurate previews of Pro settings. After installing Pro and activating a license, those controls become available in the same RESTful JSON API admin area.

Free plugin
With Pro active
/wp-admin/admin.php?page=restful-json-api
API Config Controllers CachingPRO Rate Limiting Log Documentation
Caching

Cache successful anonymous read-only responses using WordPress transients.

Cache duration
Exclude endpointuser/login
Exclude endpointposts/create_post
This tab is part of RESTful JSON API Pro
Same layout — becomes fully functional the moment Pro is active with a valid license.
Upgrade to Pro
1
Install the free plugin

All four Pro tabs are already visible — accurate layout, disabled fields, upgrade overlay.

2
Install Pro + activate license

Pro detects the free plugin, announces itself, enter the license key in the License tab.

3
Same screen — real controls

Disabled fields become live settings in the exact same positions. Try the toggle above.

Click the dots to preview each Pro tab.

For developers evaluating the architecture

A separate Pro add-on built on stable extension points.

The free plugin remains the API foundation. Pro depends on it, replaces the Posts controller when licensed, and attaches operational features through named hooks.

Core never imports Pro's code. The only question core asks is a single filter (restful_json_api_pro_active) — everything else is Pro's own decision.
Pro tabs exist in free as accurate previews. Same layout, disabled fields, "Upgrade" overlay. Installing Pro makes them real without moving anything.
Pro works through named extension points. Caching, rate limiting, and logging attach to dispatch hooks, so the free API stays focused while production controls remain modular.
One class per concern. Pro ships as Caching, Rate_Limiting, Logging, Settings_Tabs — each hooks only the extension point it needs.
License gates features, not installs. An unlicensed install shows the upgrade mock-ups again, not an error screen.
restful_json_api_early_dispatchPRO
Before controller validation — the rate limiter can stop abusive requests before endpoint-specific database work runs.
restful_json_api_before_dispatch
Core is about to run the matched controller method.
restful_json_api_cached_resultPRO
Filter — Caching checks for a fresh transient and short-circuits if one exists.
[ controller method runs ]
e.g. posts/get_recent_posts, posts/create_post
restful_json_api_after_dispatchPRO
Caching stores the response; Logging records the call if endpoint is on the audit list.
restful_json_api_save_settings
Fired from inside core's nonce-verified settings save — Pro hooks in to persist its own options safely.
restful_json_api_admin_menu
Companion plugins (Pro, User Plus) hook this to add their submenu items under the top-level menu.
FAQ

Frequently Asked Questions

Do I need Pro to use the plugin?+

No. The free plugin includes Core, Posts read, Respond, Widgets, and User endpoints. Pro adds post create/update/delete plus caching, rate limiting, logging, and the transients manager around the API you're already running.

What does Pro add to the free API?+

Pro replaces the free read-only Posts controller with an expanded controller for protected post and CPT writes, taxonomy term management, taxonomy assignment, and post-meta operations. It also adds anonymous response caching, token-bucket rate limiting, audit logging, API-cache transient management, and license-managed settings screens.

Can I build a mobile app around CPTs and ACF fields?+

Yes. The free Posts controller can discover post types, taxonomies, terms, media, attachments, and comments. Pro write endpoints accept post_type, taxonomies[...], and meta[...], so an app can create and update CPT content with ACF-style custom fields and featured images.

Is this useful for AI agents building WordPress apps?+

Yes. Claude, Codex, Gemini, Copilot, Grok, and other AI builders can follow a simple pattern: install RESTful JSON API, enable the needed controllers, call user/login for a JWT, then use controller endpoints such as posts/get_post_types, posts/get_taxonomies, and Pro posts/create_post.

Does the plugin still use cookie authentication?+

No. Cookie auth endpoints were removed. Clients now authenticate with user/login, receive a JWT, and send it as Authorization: Bearer ACCESS_TOKEN on protected endpoints.

Do users need Application Passwords?+

No. The plugin issues its own JWT tokens, so users do not need to manually create WordPress Application Passwords before using a mobile app or external client.

When do I actually need the CORS setting?+

Only when a web app hosted on a different domain calls this API directly from browser JavaScript. Mobile apps, cron jobs, and server-to-server calls are never affected by CORS — it's a browser-only mechanism.

Does Logging store request content or passwords?+

No. Logging records only the timestamp, endpoint, user ID (if any), affected object ID, and IP address. The actual request body — including passwords or tokens — is never written to the log.

Can I move my Pro license to a different site?+

Yes. Click "Deactivate License" on the current site to free the seat, then enter the same key on the new site and activate. Licenses are seat counts, not domain locks.

What happens after my year of updates runs out?+

The plugin keeps working as installed. You won't receive new feature updates or priority support until you renew — but there's no expiry on the software itself.

From the blog

Resources & Articles

In-depth guides on caching, rate limiting, migration, and how RESTful JSON API Pro works under the hood.

No posts found.

Get in touch

Questions? Custom requirements?

Pre-sales questions, custom endpoints, or agency licensing — send a message and we'll reply within one business day.

Pre-sales questions

Not sure which plan fits? Describe your use case and we'll tell you.

🔌
Custom endpoints

Business and Developer plans include bundled dev hours. Need more? Get a quote.

🤝
Agency / bulk licensing

Running 10+ sites? We can discuss volume arrangements.

    Send us a message




    Ready when you are

    Start free. Upgrade when your app is ready to publish and scale.

    Use the free plugin to connect WordPress, read content, and build user flows. Choose Pro when you need protected CPT writes, taxonomy and custom-field management, caching, rate limiting, audit logs, and commercial support.