JSON API Auth

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

37 searches this plugin appeared in over the last 90 days, 11 listed. 26 left out as unrelated or noise (years, numbers, stray words). 1 of its tags isn't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 24% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2 months ago and a band this size takes about a year or more to cross, so the real count is still just under 700.

1. ★★★★★ Sarankumar

   9.4y ago

   Working perfectly

   Read on wp.org ↗
2. ★★★★★ metaeditor

   10.1y ago

   Great piece of Cake, but incompatible to the Jsone APi Plugin Authentication only for “new” own Controller This topic was modified 9 years, 7 months ago by metaeditor.

   Read on wp.org ↗
3. ★★★★★ mainsufian

   10.7y ago

   Hi, I am using the awesome JSON API plugin. it was a nice experience. really thankyou

   Read on wp.org ↗
4. ★★★★★ thinkerman

   10.9y ago

   Hi, I am using the awesome JSON API plugin. I read I can’t have access to the posts postmeta unless I’m authenticated and I thought maybe your plugin is the solution to that. I have installed your plugin but not entirely sure how to use it in my application.

   Read on wp.org ↗
5. ★★★★★ necro_txilok

   11.9y ago

   I think this plugin is very good as complement of json-api but I miss some funtionality very important to make the plugin works well. I’ve tested this plugin with json-api but I think that modify the plugin json-api as you propose in this threat https://wordpress.org/support/topic/error-you-need-to-login-with-a-user-that-has-edit_posts-capacity?replies=6 Error: You need to login with a user that has ‘edit_posts’ capacity. is not a good solution because you are asking people to modify another plugin that works well itself. I’ve made my own solution by modifing this plugin with the next lines: 1 – Add a new action after “add_filter(‘json_api_auth_controller_path’, ‘setAuthControllerPath’);” in json-api-auth.php: add_action('init', 'checkAuthCookie', 100); 2 – Add a new function at the end: function checkAuthCookie($sDefaultPath) { global $json_api; if ($json_api->query->cookie) { $user_id = wp_validate_auth_cookie($json_api->query->cookie, 'logged_in'); if ($user_id) { $user = get_userdata($user_id); wp_set_current_user($user->ID, $user->user_login); } } } This modification set current user if we pass a valid auth cookie in the request enabling features of json-api for that user. I was checking the ‘clear_auth_cookie’ method too and it doesn’t work. The call ‘wp_generate_auth_cookie’ in this method generates a new cookie but the cookies generated before with “generate_auth_cookie” still working. I’ve tried to use the WordPress method ‘wp_clear_auth_cookie’ to clear all cookies, but the generated string still working again because the method from WordPress does not validate if the cookie exists, only if the string is valid. This could be a security problem because someone can steal the cookie string and authenticate as that user using this method. However this problem must be fixed in WordPress core. I hope this could help you to improve this plugin or another developers that need this functionality working at 100%.

   Read on wp.org ↗
6. ★★★★★ bperney

   12.6y ago

   Hello, First, thank you for your plugin, it seems useful. However, before trying to use it, I would like to know if it could solve my problem. I am using the plugin restricted site access : https://wordpress.org/plugins/restricted-site-access/ I want to access the JSON from a phonegap app. If the user is connected, then it can access the content of my website. Is it possible to use your add-on in order to let the user connect from the mobile app, and then access to the content thanks to the cookie ? Will it go through the plugin “Restricted Site Access” ? I don’t know exactly how to use it, but if I can do it, then I will try, but first I want to know if it’s possible. Thank you, Benjamin.

   Read on wp.org ↗
7. ★★★★★ kisekicyd

   12.6y ago

   Thank you for this.. My only problem is that I dont know how to used it.. any tutorial you can give me?.. I mean step by step tutorial.. BTW thanks for this, because im building a native app that will use wordpress website as a content management only and the app will just pull the data on it…

   Read on wp.org ↗
8. ★★★★★ SOGO

   12.7y ago

   thanks for sharing

   Read on wp.org ↗

The 1 disclosed vulnerability is patched in the current version (3.1.3). Sites still on an older version should update.

1. Patched Critical · 9.8 JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response ↗
   2026-10-01 CVE-2026-97637 Improper Authentication Affects <= 3.1.2 Patched in 3.1.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-08-22 700+ → 600+ down after 2 days in tier
2. 2026-08-20 600+ → 700+ up after 2 days in tier
3. 2026-08-18 700+ → 600+ down after 129 days in tier
4. 2026-04-11 800+ → 700+ down after 4 days in tier
5. 2026-04-07 700+ → 800+ up after 1 days in tier
6. 2026-04-06 800+ → 700+ down after 134 days in tier
7. 2025-11-23 900+ → 800+ down after 202 days in tier
8. 2025-05-05 1K+ → 900+ down after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for JSON API Auth into a readme, a review or a deck. It updates itself.

JSON API Auth: 600+ active installs, 4.7★ (11 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/json-api-auth