DMSI Advanced API supports three authentication methods. All three use the standard HTTP Authorization: Bearer <token> header. The authentication middleware automatically detects the token type based on its format and routes validation accordingly.
Authentication Methods #
| Method | Token Format | Best For |
|---|---|---|
| API Key | dmsi_key_<40hex> | Server-to-server integrations, long-lived credentials |
| JWT Bearer Token | Three dot-separated base64 segments | Short-lived sessions, stateless access |
| OAuth 2.0 | OAuth access token | Third-party application integrations, user-delegated access |
Token Type Detection #
The middleware (DMSI_AAPI_Auth_Middleware) detects the token type automatically:
| Token Prefix / Pattern | Validation Path |
|---|---|
Starts with dmsi_key_ | API Key validation |
Starts with dmsi_sand_ | Sandbox Key validation |
| Three dot-separated base64 segments | JWT (RS256) validation |
| All other formats | OAuth token validation |
Public Endpoints (No Authentication Required) #
The following endpoints do not require any authentication:
| Endpoint | Description |
|---|---|
GET /wp-json/dmsi-api/v1/health | Plugin and database health check |
GET /wp-json/dmsi-api/v1/docs/* | OpenAPI specification (JSON and YAML) |
GET/POST /wp-json/dmsi-api/v1/oauth/authorize | OAuth 2.0 authorization endpoint |
POST /wp-json/dmsi-api/v1/oauth/token | OAuth 2.0 token endpoint |
POST /wp-json/dmsi-api/v1/oauth/revoke | OAuth 2.0 token revocation |
POST /wp-json/dmsi-api/v1/auth/token | Exchange API key for JWT pair |
POST /wp-json/dmsi-api/v1/auth/refresh | Refresh an expired JWT access token |
GET /wp-json/dmsi-api/v1/auth/jwks | JWKS public key set |
Admin Endpoints #
Endpoints under /wp-json/dmsi-api/v1/admin/ require either:
- An API key or OAuth token with the
adminscope, or - A valid WordPress admin session cookie with a corresponding nonce