WPGraphQL JWT Authentication

https://github.com/wp-graphql/wp-graphql-jwt-authentication
Admin
This plugin extends WPGraphQL to provide authentication for WordPress using JWT (JSON Web Tokens),...
Tokens:38,577
Snippets:230
Trust Score:7.9
License:GPL-3.0
Update:4 weeks ago
Show doc for...
Tokens:
Raw
### Manual access to the singleton / hooking into initialization

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

Retrieve the singleton instance and react to its initialization. The 'graphql_jwt_authentication_init' action receives the instance as its argument; the example logs that the plugin initialized.

```php
<?php
// Retrieve the singleton and react to its initialization.
$plugin = \WPGraphQL\JWT_Authentication\JWT_Authentication::instance();

// The action receives the instance as its argument.
add_action( 'graphql_jwt_authentication_init', function( $instance ) {
	// e.g. log that the plugin initialized
	error_log( 'WPGraphQL JWT Auth initialized' );
}, 10, 1 );
```

--------------------------------

### Calling login_and_get_token with try-catch

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

Example of calling the function with a username and password, retrieving the auth and refresh tokens, and catching UserError exceptions for invalid credentials or user not found.

```php
<?php
try {
	$result = Auth::login_and_get_token( 'admin', 'hunter2' );
	$auth_token    = $result['authToken'];
	$refresh_token = $result['refreshToken'];
} catch ( \GraphQL\Error\UserError $e ) {
	error_log( $e->getMessage() ); // invalid credentials / user not found
}
```

--------------------------------

### Calling Auth::get_auth_header()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

Example call to Auth::get_auth_header(). The comment indicates the return value can be a Bearer token string, a REDIRECT fallback, or null.

```php
<?php
$header = Auth::get_auth_header(); // 'Bearer <token>', REDIRECT fallback, or null
```

--------------------------------

### Login mutation example

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/login.md

GraphQL mutation to log in a user. It generates an auth token and refresh token, and returns the user's id and name.

```graphql
mutation LoginUser {
  login( input: {
    clientMutationId: "uniqueId",
    username: "your_login",
    password: "your password"
  } ) {
    authToken
    refreshToken
    user {
      id
      name
    }
  }
}
```

--------------------------------

### Observed HTTP response headers with tokens

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/manage-tokens.md

Example of HTTP response headers when SSL or GRAPHQL_DEBUG is enabled, showing X-JWT-Auth and X-JWT-Refresh headers with placeholder tokens.

```text
Access-Control-Expose-Headers: X-JWT-Auth,X-JWT-Refresh
X-JWT-Auth: <new 5-minute auth token>        # when Refresh-Authorization was valid
X-JWT-Refresh: <new 1-year refresh token>    # when Authorization was valid
```

--------------------------------

### Calling Auth::get_refresh_header()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

Example call to Auth::get_refresh_header(). The comment indicates the return type is string or false, representing the HTTP_REFRESH_AUTHORIZATION header value.

```php
<?php
Auth::get_refresh_header(); // string|false — HTTP_REFRESH_AUTHORIZATION
```

--------------------------------

### Login mutation with invalid credentials

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/login.md

Example of a login mutation with incorrect credentials, which will result in GraphQL errors with the message from the WordPress authentication function.

```graphql
mutation LoginUser {
  login( input: {
    clientMutationId: "id-1",
    username: "admin",
    password: "wrong-password"
  } ) {
    authToken
  }
}

# → "errors": [{ "message": "incorrect password" (or the WP auth error), ... }]
# (message text comes from WP's wp_authenticate; see errors.md)
```

--------------------------------

### Get JWT token with Auth::get_token

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

The first block is the public static method `get_token` from `src/Auth.php:312-318`. It returns a signed HS256 JWT string, `null`, or a `\WP_Error` with code `graphql-jwt-no-permissions` (status forced to 400) when `$cap_check` is `true` and the current user does not match or the user ID is `0`. The second block shows two usage examples: one with the default capability check and one for a server-side flow with `$cap_check` set to `false`.

```php
/**
 * Public method for getting an Auth token for a given user
 *
 * @param \WP_User $user The user to get the token for
 * @param boolean $cap_check Whether to check capabilities. Default is true.
 *
 * @return null|string|\WP_Error
 */
public static function get_token( $user, $cap_check = true ) {
	return self::get_signed_token( $user, $cap_check );
}
```

```php
<?php
$token = Auth::get_token( wp_get_current_user() );               // cap_check = true
$token = Auth::get_token( new \WP_User( $user_id ), false );     // server-side flow

if ( is_wp_error( $token ) ) {
	// 'graphql-jwt-no-permissions' — only the requesting user can get a token.
}
```

--------------------------------

### login mutation request body

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/endpoints.md

Example request body for the login mutation. Sent via POST to the WPGraphQL endpoint with a JSON body containing the query and variables. The input requires username and password; clientMutationId is optional.

```json
{
  "query": "mutation LoginUser($input: LoginInput!) { login(input: $input) { authToken refreshToken user { id name } } }",
  "variables": {
    "input": {
      "clientMutationId": "uniqueId",
      "username": "your_login",
      "password": "your password"
    }
  }
}
```

--------------------------------

### Catch UserError from Auth::login_and_get_token()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/errors.md

Server-side PHP example showing how to catch a GraphQL\Error\UserError thrown by Auth::login_and_get_token(). Logs the error message and sends a JSON error response with HTTP 401.

```php
<?php
use GraphQL\Error\UserError;

try {
	$result = Auth::login_and_get_token( $username, $password );
} catch ( UserError $e ) {
	// Invalid credentials / user not found / unconfigured secret (when thrown).
	error_log( 'Login failed: ' . $e->getMessage() );
	wp_send_json_error( [ 'message' => $e->getMessage() ], 401 );
}
```

--------------------------------

### Entry function init()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

Entry point hooked into WordPress's `plugins_loaded` action at priority 1. Returns the singleton plugin instance and is also callable directly as `\WPGraphQL\JWT_Authentication\init()`.

```php
function init() {
	return JWT_Authentication::instance();
}
add_action( 'plugins_loaded', '\WPGraphQL\JWT_Authentication\init', 1 );
```

--------------------------------

### Get token issued time with Auth::get_token_issued()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

Retrieves the Unix timestamp when the current request's tokens were issued (`iat`). The value is memoized on the static `$issued` property, so it is computed only once per request. The usage example shows calling `Auth::get_token_issued()` directly.

```php
/**
 * Get the issued time for the token
 *
 * @return int
 */
public static function get_token_issued() {
	if ( ! isset( self::$issued ) ) {
		self::$issued = time();
	}

	return self::$issued;
}
```

```php
<?php
$issued = Auth::get_token_issued(); // int; memoized per request
```

--------------------------------

### Basic bootstrap (WordPress plugin, automatic)

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

Activate the plugin like any WordPress plugin. On plugins_loaded (priority 1), it calls \WPGraphQL\JWT_Authentication\init() which returns JWT_Authentication::instance() and wires ManageTokens, Login, RefreshToken, and Auth hooks into WPGraphQL.

```php
<?php
// wp-content/plugins/wp-graphql-jwt-authentication/wp-graphql-jwt-authentication.php
// Activated like any WordPress plugin. On plugins_loaded (priority 1):
//   \WPGraphQL\JWT_Authentication\init() -> JWT_Authentication::instance()
// which wires ManageTokens, Login, RefreshToken and Auth hooks into WPGraphQL.
```

--------------------------------

### Get token expiration with Auth::get_token_expiration()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

Returns the token expiration timestamp, defaulting to 300 seconds (5 minutes) after the issued time. The expiration is filterable via the `graphql_jwt_auth_expire` filter and is memoized per request. The usage example shows shortening the lifetime to 60 seconds and then retrieving the expiration.

```php
/**
 * Returns the expiration for the token
 *
 * @return mixed|string|null
 */
public static function get_token_expiration() {

	if ( ! isset( self::$expiration ) ) {

		/**
		 * Set the expiration time, default is 300 seconds.
		 */
		$expiration = 300;

		/**
		 * Determine the expiration value. Default is 5 minutes, but is filterable to be configured as needed
		 *
		 * @param string $expiration The timestamp for when the token should expire
		 */
		self::$expiration = self::get_token_issued() + apply_filters( 'graphql_jwt_auth_expire', $expiration );
	}

	return ! empty( self::$expiration ) ? self::$expiration : null;
}
```

```php
<?php
add_filter( 'graphql_jwt_auth_expire', function( $expiration ) {
	return 60; // shorten auth token lifetime (see configuration.md)
} );
$exp = Auth::get_token_expiration(); // issued + 60
```

--------------------------------

### init()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

The init() function is the entry point for the JWT Authentication plugin, returning the singleton instance of the JWT_Authentication class.

```APIDOC
## [FUNCTION] init()

### Description
Initializes the JWT Authentication plugin by returning the singleton instance of the JWT_Authentication class. This function is hooked into WordPress's `plugins_loaded` action and can also be called directly.

### Method
Function

### Endpoint
`\WPGraphQL\JWT_Authentication\init()`

### Parameters
None

### Return Value
- **JWT_Authentication** - The singleton plugin instance.

### Usage Example
```php
\WPGraphQL\JWT_Authentication\init();
```
```

--------------------------------

### get_refresh_token() method and usage example

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

The get_refresh_token method returns a long-lived JWT for a WP_User, with expiration defaulting to issued + 365 days (filterable via graphql_jwt_auth_refresh_token_expiration) and data.user.user_secret set from get_user_jwt_secret(). Each call appends a closure to graphql_jwt_auth_token_before_sign that self-disables via self::$is_refresh_token. The usage example shows storing the token for the Refresh-Authorization header or refreshJwtAuthToken mutation.

```php
/**
 * Given a WP_User, this returns a refresh token for the user
 * @param \WP_User $user A WP_User object
 * @param bool $cap_check
 *
 * @return null|string
 */
public static function get_refresh_token( $user, $cap_check = true ) {

	self::$is_refresh_token = true;

	add_filter( 'graphql_jwt_auth_token_before_sign', function( $token, \WP_User $user ) {
		$secret = Auth::get_user_jwt_secret( $user->ID );

		if ( ! empty( $secret ) && ! is_wp_error( $secret ) && true === self::is_refresh_token() ) {

			$token['exp']                         = apply_filters( 'graphql_jwt_auth_refresh_token_expiration', ( self::get_token_issued() + ( DAY_IN_SECONDS * 365 ) ) );
			$token['data']['user']['user_secret'] = $secret;

			self::$is_refresh_token = false;

		}

		return $token;
	}, 10, 2 );

	return self::get_signed_token( $user, $cap_check );
}
```

```php
<?php
$token = Auth::get_refresh_token( wp_get_current_user() );
// Store it for the Refresh-Authorization header or refreshJwtAuthToken mutation.
```

--------------------------------

### public static function instance()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

Returns the one true instance. Lazily constructs constants and autoloader on first call, then always runs private `init()` wiring and fires the `graphql_jwt_authentication_init` action with the instance as its first argument.

```php
public static function instance() {
	if ( ! isset( self::$instance ) && ! ( self::$instance instanceof JWT_Authentication ) ) {
		self::$instance = new JWT_Authentication;
		self::$instance->setup_constants();
		self::$instance->includes();
	}

	self::$instance->init();

	/**
	 * Fire off init action
	 *
	 * @param JWT_Authentication $instance The instance of the Init_JWT_Authentication class
	 */
	do_action( 'graphql_jwt_authentication_init', self::$instance );

	/**
	 * Return the Init_JWT_Authentication Instance
	 */
	return self::$instance;
}
```

--------------------------------

### Class JWT_Authentication (final, singleton)

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

Final singleton class holding the plugin instance, defining constants, loading Composer's autoloader, and wiring hook registrations. Has no public properties.

```php
final class JWT_Authentication {
	private static $instance;
	...
}
```

--------------------------------

### JWT_Authentication::instance()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

The instance() static method provides access to the singleton JWT_Authentication instance, initializing it if necessary and firing the graphql_jwt_authentication_init action.

```APIDOC
## [METHOD] JWT_Authentication::instance()

### Description
Returns the one true instance of the JWT_Authentication singleton class. On first call, it lazily constructs the instance, sets up constants, and includes necessary files. On subsequent calls, it runs the private init() wiring and fires the `graphql_jwt_authentication_init` action.

### Method
Static Method

### Endpoint
`JWT_Authentication::instance()`

### Parameters
None

### Return Value
- **JWT_Authentication** - The singleton plugin instance.

### Usage Example
```php
$instance = JWT_Authentication::instance();
```
```

--------------------------------

### GraphQL mutation to refresh auth token

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/refresh-token.md

Example mutation that exchanges a valid refresh token for a new auth token. The jwtRefreshToken field is required.

```graphql
mutation RefreshAuthToken {
  refreshJwtAuthToken(
    input: {
      clientMutationId: "uniqueId",
      jwtRefreshToken: "your_refresh_token"
    }
  ) {
    authToken
  }
}
```

--------------------------------

### Import Login class

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/login.md

Imports the Login class from the WPGraphQL JWT Authentication plugin.

```php
use WPGraphQL\JWT_Authentication\Login;
```

--------------------------------

### Import ManageTokens class

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/manage-tokens.md

Use this import to reference the ManageTokens class in your code.

```php
use WPGraphQL\JWT_Authentication\ManageTokens;
```

--------------------------------

### Import RefreshToken class

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/refresh-token.md

Import the RefreshToken class from the WPGraphQL JWT Authentication plugin.

```php
use WPGraphQL\JWT_Authentication\RefreshToken;
```

--------------------------------

### GraphQL mutation with invalid refresh token

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/refresh-token.md

Example mutation with an invalid refresh token, resulting in an error message 'The provided refresh token is invalid'.

```graphql
mutation RefreshAuthToken {
  refreshJwtAuthToken(
    input: {
      clientMutationId: "id-1",
      jwtRefreshToken: "not-a-real-token"
    }
  ) {
    authToken
  }
}

# → "errors": [{ "message": "The provided refresh token is invalid", ... }]
```

--------------------------------

### Import Auth class

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

Import the Auth class from the WPGraphQL JWT Authentication plugin.

```php
use WPGraphQL\JWT_Authentication\Auth;
```

--------------------------------

### Import plugin classes

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/index.md

Import the plugin's main classes from the WPGraphQL\JWT_Authentication namespace. These classes are autoloaded via Composer PSR-4 from the src/ directory.

```php
use WPGraphQL\JWT_Authentication\Auth;
use WPGraphQL\JWT_Authentication\Login;
use WPGraphQL\JWT_Authentication\RefreshToken;
use WPGraphQL\JWT_Authentication\ManageTokens;
```

--------------------------------

### login

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/login.md

Registers the login GraphQL mutation on the WPGraphQL schema. The mutation authenticates a user with username/password and returns an auth token, a refresh token, and the logged-in user.

```APIDOC
## login

### Description
Registers the `login` GraphQL mutation on the WPGraphQL schema. The mutation authenticates a user with username/password and returns an auth token, a refresh token, and the logged-in user.

### Method
mutation

### Endpoint
login

### Parameters
#### Input Fields (LoginInput)
- **username** (String!) - Required - The username used for login. Typically a unique or email address depending on specific configuration.
- **password** (String!) - Required - The plain-text password for the user logging in.
- **clientMutationId** (String) - Optional - Standard WPGraphQL mutation input.

### Request Example
```graphql
mutation LoginUser {
  login( input: {
    clientMutationId: "uniqueId",
    username: "your_login",
    password: "your password"
  } ) {
    authToken
    refreshToken
    user {
      id
      name
    }
  }
}
```

### Response
#### Success Response
- **authToken** (String) - JWT Token that can be used in future requests for Authentication.
- **refreshToken** (String) - A JWT token that can be used in future requests to get a refreshed jwtAuthToken. If the refresh token used in a request is revoked or otherwise invalid, a valid Auth token will NOT be issued in the response headers.
- **user** (User) - The user that was logged in.

#### Response Example
```graphql
{
  "data": {
    "login": {
      "authToken": "...",
      "refreshToken": "...",
      "user": {
        "id": "...",
        "name": "..."
      }
    }
  }
}
```

### Error Handling
Invalid credentials propagate as GraphQL errors. Example:

```graphql
mutation LoginUser {
  login( input: {
    clientMutationId: "id-1",
    username: "admin",
    password: "wrong-password"
  } ) {
    authToken
  }
}

# → "errors": [{ "message": "incorrect password" (or the WP auth error), ... }]
# (message text comes from WP's wp_authenticate; see errors.md)
```
```

--------------------------------

### public function __wakeup()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

Forbids unserializing the singleton; triggers `_doing_it_wrong`.

```php
public function __wakeup() {
	// De-serializing instances of the class is forbidden.
	_doing_it_wrong( __FUNCTION__, esc_html__( 'De-serializing instances of the WPGraphQL class is not allowed', 'wp-graphql-jwt-authentication' ), '0.0.1' );
}
```

--------------------------------

### Customize JWT expiration with graphql_jwt_auth_expire filter

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/README.md

PHP filter to change the auth token expiration time. The default is 300 seconds; for security, it is recommended to keep it short. The example sets expiration to 60 seconds.

```php
function custom_jwt_expiration( $expiration ) {
    return 60;
}

add_filter('graphql_jwt_auth_expire', 'custom_jwt_expiration', 10);
```

--------------------------------

### Filter secret key and expiration with graphql_jwt_auth_secret_key and graphql_jwt_auth_expire

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/configuration.md

Overrides the server-side secret and shortens token expiration to 60 seconds. The README security note advises keeping tokens short-lived; the example sets a 60-second expiration.

```php
<?php
add_filter( 'graphql_jwt_auth_secret_key', function() {
	return 'your-secret-token';
} );

// Security note in README: keep auth tokens short-lived; don't exceed 300s
// without good reason. This shortens them to 60s.
add_filter( 'graphql_jwt_auth_expire', function( $expiration ) {
	return 60;
} );
```

--------------------------------

### ManageTokens::init() - Hook wiring

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/manage-tokens.md

Wires the class methods as WordPress actions and filters. Called once from JWT_Authentication::init(). Registers JWT fields, adds mutation input fields, filters signed tokens to block revoked users, and adds auth headers to GraphQL and REST responses.

```php
/**
 * Initialize the funcionality for managing tokens
 */
public static function init() {
	// Register JWT fields.
	add_action( 'graphql_register_types', [ __CLASS__, 'add_jwt_fields' ], 10 );

	// Add fields to the input for user mutations.
	add_action( 'graphql_register_types', [ __CLASS__, 'add_user_mutation_input_fields' ] );
	add_action( 'graphql_user_object_mutation_update_additional_data', [ __CLASS__, 'update_jwt_fields_during_mutation' ], 10, 3 );

	// Filter the signed token, preventing it from returning if the user has had their JWT Secret revoked.
	add_filter( 'graphql_jwt_auth_signed_token', [ __CLASS__, 'prevent_token_from_returning_if_revoked' ], 10, 2 );

	// Filter the GraphQL response headers.
	add_filter( 'graphql_response_headers_to_send', [ __CLASS__, 'add_tokens_to_graphql_response_headers' ] );
	add_filter( 'graphql_response_headers_to_send', [ __CLASS__, 'add_auth_headers_to_response' ] );

	/**
	 * Add Auth Headers to REST REQUEST responses
	 *
	 * This allows clients to use WPGraphQL JWT Authentication
	 * tokens with WPGraphQL _and_ with REST API requests, and
	 * this exposes refresh tokens in the REST API response
	 * so folks can refresh their tokens after each REST API
	 * request.
	 */
	add_filter( 'rest_request_after_callbacks', [ __CLASS__, 'add_auth_headers_to_rest_response' ], 10, 3 );

	// Filter allowed HTTP headers.
	add_filter( 'graphql_access_control_allow_headers', [ __CLASS__, 'add_jwt_allowed_headers' ] );
}
```

--------------------------------

### Get user JWT secret with Auth::get_user_jwt_secret

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

Retrieves the JWT secret for a user, stored in the `graphql_jwt_auth_secret` user meta. Returns `null` when the secret is revoked or the caller lacks the `edit_users` capability (default, filterable via `graphql_jwt_auth_edit_users_capability`). The secret is filtered through `graphql_jwt_auth_user_secret`.

```php
/**
 * Given a User ID, returns the user's JWT secret
 *
 * @param int $user_id
 *
 * @return mixed|string
 */
public static function get_user_jwt_secret( $user_id ) {
```

```php
<?php
$secret = Auth::get_user_jwt_secret( get_current_user_id() );
if ( null === $secret ) {
	// Secret revoked, or caller lacks edit_users capability.
}
```

--------------------------------

### Check if JWT secret is revoked with Auth::is_jwt_secret_revoked

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

The first block is the public static method `is_jwt_secret_revoked` from `src/Auth.php:300-307`. It returns `true` when the `graphql_jwt_auth_secret_revoked` user meta is truthy. The second block shows a usage example: if the method returns `true`, no tokens are issued for that user until un-revoked or refreshed.

```php
/**
 * Given a User, returns whether their JWT secret has been revoked or not.
 *
 * @param int $user_id
 *
 * @return bool
 */
public static function is_jwt_secret_revoked( $user_id ) {
	$revoked = (bool) get_user_meta( $user_id, 'graphql_jwt_auth_secret_revoked', true );

	return isset( $revoked ) && true === $revoked ? true : false;
}
```

```php
<?php
if ( Auth::is_jwt_secret_revoked( $user_id ) ) {
	// No tokens issued for this user until un-revoked/refreshed.
}
```

--------------------------------

### Mutation: login

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/endpoints.md

Authenticates a user with username and password, returning JWT tokens and user details. No prior authentication is required.

```APIDOC
## Mutation: login

### Description
Authenticates a user with username and password, returning JWT tokens and user details. No prior authentication is required.

### Method
POST

### Endpoint
/graphql

### Parameters
#### Request Body
- **clientMutationId** (String) - Optional - WPGraphQL-standard client mutation identifier
- **username** (String!) - Required - Login; sanitized via `sanitize_user()`
- **password** (String!) - Required - Plain-text password; trimmed via `trim()`

### Request Example
{
  "query": "mutation LoginUser($input: LoginInput!) { login(input: $input) { authToken refreshToken user { id name } } }",
  "variables": {
    "input": {
      "clientMutationId": "uniqueId",
      "username": "your_login",
      "password": "your password"
    }
  }
}

### Response
#### Success Response (200)
- **clientMutationId** (String) - Echo of the request value (WPGraphQL standard)
- **authToken** (String) - HS256 JWT, default expiry `issued + 300s`; use as `Authorization: Bearer <token>`
- **refreshToken** (String) - Long-lived JWT (default `issued + 365 days`) embedding the user secret
- **user** (User) - The authenticated user object

#### Response Example
{
  "data": {
    "login": {
      "authToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "user": {
        "id": "dXNlcjox",
        "name": "admin"
      }
    }
  }
}
```

--------------------------------

### Check if current token is a refresh token with Auth::is_refresh_token()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

The first block shows the implementation of the static method `is_refresh_token()`, which returns `true` if the token currently being composed is a refresh token, otherwise `false`. The second block demonstrates a usage example, noting that it returns `true` while `get_refresh_token()` composes a token.

```php
public static function is_refresh_token() {
	return true === self::$is_refresh_token ? true : false;
}
```

```php
<?php
Auth::is_refresh_token(); // true while get_refresh_token() composes a token
```

--------------------------------

### Revoke user JWT secret with Auth::revoke_user_secret()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/auth.md

The first block shows the method signature and docblock for `revoke_user_secret()`, which revokes the JWT secret for a user if the user is valid and the current user has proper capabilities. The second block demonstrates a usage example, checking for a `WP_Error` with the code `graphql-jwt-auth-cannot-revoke-secret` when the user is invalid or lacks capability.

```php
/**
 * Given a user ID, if the ID is for a valid user and the current user has proper capabilities, this revokes
 * the JWT Secret from the user.
 *
 * @param int $user_id
 *
 * @return mixed|boolean|\WP_Error
 */
public static function revoke_user_secret( $user_id ) {
```

```php
<?php
$result = Auth::revoke_user_secret( $user_id );
if ( is_wp_error( $result ) ) {
	// 'graphql-jwt-auth-cannot-revoke-secret' — user invalid or insufficient capability.
}
```

--------------------------------

### JWT_Authentication::__wakeup()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

The __wakeup() magic method is overridden to forbid unserialization of the singleton instance, triggering a _doing_it_wrong notice if attempted.

```APIDOC
## [METHOD] JWT_Authentication::__wakeup()

### Description
Prevents unserialization of the singleton instance. Calling this method triggers a `_doing_it_wrong` notice.

### Method
Magic Method

### Endpoint
`JWT_Authentication::__wakeup()`

### Parameters
None

### Behavior
- Throws a `_doing_it_wrong` notice if called.
```

--------------------------------

### public function __clone()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

Forbids cloning the singleton; calling it triggers `_doing_it_wrong`.

```php
public function __clone() {
	// Cloning instances of the class is forbidden.
	_doing_it_wrong( __FUNCTION__, esc_html__( 'The Init_JWT_Authentication class should not be cloned.', 'wp-graphql-jwt-authentication' ), '0.0.1' );
}
```

--------------------------------

### Allow additional domains with graphql_jwt_auth_iss_allowed_domains

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/configuration.md

Adds a staging domain to the allowed issuer domains. Combine with issuing tokens on that domain via graphql_jwt_auth_token_before_sign / iss claim overrides.

```php
<?php
add_filter( 'graphql_jwt_auth_iss_allowed_domains', function( $domains ) {
	$domains[] = 'https://staging.example.com';
	return $domains;
} );
// Combined with issuing tokens on that domain via
// graphql_jwt_auth_token_before_sign / iss claim overrides.
```

--------------------------------

### LoginInput inputFields definition

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/types.md

Defines the input fields for the LoginInput GraphQL mutation input type, as registered in Login::register_mutation(). Requires username and password as non-null strings.

```php
'inputFields' => [
    'username' => [
        'type'        => [ 'non_null' => 'String' ],
        'description' => __( 'The username used for login. Typically a unique or email address depending on specific configuration', 'wp-graphql-jwt-authentication' ),
    ],
    'password' => [
        'type'        => [ 'non_null' => 'String' ],
        'description' => __( 'The plain-text password for the user logging in.', 'wp-graphql-jwt-authentication' ),
    ],
],
```

--------------------------------

### JWT_Authentication::__clone()

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

The __clone() magic method is overridden to forbid cloning of the singleton instance, triggering a _doing_it_wrong notice if attempted.

```APIDOC
## [METHOD] JWT_Authentication::__clone()

### Description
Prevents cloning of the singleton instance. Calling this method triggers a `_doing_it_wrong` notice.

### Method
Magic Method

### Endpoint
`JWT_Authentication::__clone()`

### Parameters
None

### Behavior
- Throws a `_doing_it_wrong` notice if called.
```

--------------------------------

### init_graphql_request callback for JWT auth enforcement

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/jwt-authentication.md

Adds an action on init_graphql_request that checks the JWT secret and validates tokens. If the secret is missing or equals 'graphql-jwt-auth', it logs a debug notice; otherwise it validates the token and throws an exception on error before field resolution.

```php
add_action( 'init_graphql_request', function() {

	$jwt_secret = Auth::get_secret_key();
	if ( empty( $jwt_secret ) || 'graphql-jwt-auth' === $jwt_secret ) {
		graphql_debug( __( 'You must define the GraphQL JWT Auth secret to use the WPGraphQL JWT Authentication plugin.', 'graphql-jwt-auth' ) );
	} else {
		$token = Auth::validate_token();
		if ( is_wp_error( $token ) ) {
			add_action( 'graphql_before_resolve_field', function() use ( $token ) {
				throw new \Exception( esc_html( $token->get_error_message() ) );
			}, 1 );
		}
	}

} );
```

--------------------------------

### register_mutation() method

Source: https://github.com/wp-graphql/wp-graphql-jwt-authentication/blob/develop/_autodocs/api-reference/login.md

Registers the 'login' mutation via register_graphql_mutation(). Defines non-null username and password input fields, output fields for authToken, refreshToken, and user, and a payload callback that authenticates via Auth::login_and_get_token().

```php
/**
 * Register the mutation.
 */
public static function register_mutation() {
	register_graphql_mutation(
		'login',
		[
			'description'         => __( 'Login a user. Request for an authToken and User details in response', 'wp-graphql-jwt-authentication' ),
			'inputFields'         => [
				'username' => [
					'type'        => [ 'non_null' => 'String' ],
					'description' => __( 'The username used for login. Typically a unique or email address depending on specific configuration', 'wp-graphql-jwt-authentication' ),
				],
				'password' => [
					'type'        => [ 'non_null' => 'String' ],
					'description' => __( 'The plain-text password for the user logging in.', 'wp-graphql-jwt-authentication' ),
				],
			],
			'outputFields'        => [
				'authToken'    => [
					'type'        => 'String',
					'description' => __( 'JWT Token that can be used in future requests for Authentication', 'wp-graphql-jwt-authentication' ),
				],
				'refreshToken' => [
					'type'        => 'String',
					'description' => __( 'A JWT token that can be used in future requests to get a refreshed jwtAuthToken. If the refresh token used in a request is revoked or otherwise invalid, a valid Auth token will NOT be issued in the response headers.', 'wp-graphql-jwt-authentication' ),
				],
				'user'         => [
					'type'        => 'User',
					'description' => __( 'The user that was logged in', 'wp-graphql-jwt-authentication' ),
				],
			],
			'mutateAndGetPayload' => function( $input, AppContext $context, ResolveInfo $info ) {
				// Login the user in and get an authToken and user in response.
				return Auth::login_and_get_token( sanitize_user( $input['username'] ), trim( $input['password'] ) );
			},
		]
	);
}
```
Tokens:
Raw