Disable REST API and Require JWT / OAuth Authentication

FAQ

Installation Instructions

1. Head over to Plugins > Add New in the admin
2. Search for “Disable REST API and Require Authentication”
3. Install & activate the plugin
4. Now your REST API endpoints are disabled for non-authenticated requests.

How is this different from Disable REST API?

This plugin is similar to Disable REST API, wherein it disables all REST API endpoints, but it still allows the authentication endpoints provided by:

• JWT Authentication for WP REST API
• WP OAuth Server

And if a Bearer Token Authentication is provided, then the REST API becomes available.

How can I check if my REST API is disabled?

Open a new incognito browser tab or private browser tab and visit your wp-json URL:

http://mysite/wp-json/

You will see this message:

{"code":"rest_not_logged_in","message":"You are not currently logged in.","data":{"status":401}}

What is a Bearer Token Authenticated REST API request?

A Bearer Token Authenticated REST API request is a REST API call with this header:

Authorization: Bearer XXXXXXX

The XXXXXXX corresponds to the authentication token given by any of these 2 plugins:

• JWT Authentication for WP REST API
• WP OAuth Server

How do I implement JWT / OAuth authentication?

That is outside the scope of this plugin, please refer to the docs of the respective plugins:

• JWT Authentication for WP REST API
• WP OAuth Server

How do I whitelist other REST API endpoints? (via filter hook)

I’ve placed a filter called reqauth/allowed_endpoints where you can add your own REST API endpoints to the whitelist.

For example, I want to allow /my-endpoint for non-authorized REST API calls:

add_filter( 'reqauth/allowed_endpoints', 'allow_my_endpoints' );
function( $allowed_endpoints ) {
    $allowed_endpoints[] = '/my-endpoint';
    return $allowed_endpoints;
}