JWT authentication provides short-lived, stateless access tokens. Exchange an API key for a JWT token pair, then use the access token for subsequent requests. When the access token expires, use the refresh token to obtain a new pair without re-presenting the API key.

Obtaining a JWT Token Pair #

Send a POST request to the token endpoint with your API key:

curl -X POST https://yoursite.com/wp-json/dmsi-api/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"api_key": "dmsi_key_<your-40-hex-chars>"}'

Response:

{
  "access_token": "<jwt-access-token>",
  "refresh_token": "<opaque-refresh-token>",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Using the Access Token #

Include the access token in the Authorization header:

curl https://yoursite.com/wp-json/dmsi-api/v1/licenses \
  -H "Authorization: Bearer <jwt-access-token>"

Token Properties #

Refreshing an Expired Access Token #

curl -X POST https://yoursite.com/wp-json/dmsi-api/v1/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refresh_token": "<your-refresh-token>"}'

The response contains a new access_token and a new refresh_token. The previous refresh token is invalidated immediately upon use.

Public Key Set (JWKS) #

Third-party systems that need to verify JWTs independently can retrieve the public key set:

curl https://yoursite.com/wp-json/dmsi-api/v1/auth/jwks

This endpoint is public and requires no authentication.

JWT Revocation #

Individual JWTs cannot be revoked directly. However:

• Revoking the originating API key prevents new JWT pairs from being issued for that key.
• Existing unexpired JWTs issued from a revoked key will continue to be valid until their TTL expires (up to 3600 seconds by default).

The dmsi_aapi_jwt_blacklist table stores revoked JWT IDs. A daily WP-Cron job removes entries older than 30 days.