Install RESTful JSON API, add User Plus, activate your license, configure SSO providers, and start using JWT endpoints from your app.
Install RESTful JSON API from WordPress.org. It supplies the API engine, routing, controller system, settings, and JWT foundation required by User Plus.
Upload and activate User Plus, then enter your license key. Its UserPlus, PostsPlus, and BuddyPress controllers extend the parent plugin without modifying its files.
Use password login immediately, or add your Apple, Google, and Facebook credentials in the User Plus settings tabs for provider-based sign-in.
Call a login or SSO endpoint, store the returned JWT, and send Authorization: Bearer ACCESS_TOKEN with protected requests from your mobile, web, or headless app.
RESTful JSON API Free Plugin is available in the official WordPress plugin directory. Install it from inside WordPress, enable only the controllers you need, and test real content, user, JWT, comment, and widget endpoints before purchasing User Plus.
Use Core for API information, pages, search, indexes, authors, taxonomies, and menus. Enable Posts for read-only posts, pages, custom post type discovery, taxonomies, terms, media, attachments, and comments.
Test signup, JWT login, token validation, public and private profiles, avatars, password reset requests, safe user meta, and authenticated comments before deciding whether your app needs User Plus.
Respond accepts public comment submissions for decoupled frontends. Widgets returns registered sidebar output so an app or headless frontend can reuse WordPress-managed interface content.
40 endpoints · WordPress.org
Core is active by default. Turn on Posts, Respond, Widgets, and User from RESTful JSON API → Settings → Controllers. This gives developers a useful, testable API before any premium purchase.
All three plugins are designed to work as one stack. RESTful JSON API Free is always the parent; User Plus and Pro add different premium capabilities and can be installed together.
Required parent plugin. Provides controller routing, API settings, security configuration, JWT authentication, five controllers, and 40 endpoints for evaluating and building the foundation of your app.
User, SSO, and community extension. Adds advanced account workflows, Apple/Google/Facebook SSO, expanded user meta and roles, PostsPlus app-content methods, and a full JWT-protected BuddyPress controller.
Content-write and operations extension. Adds authoritative posts/* create, update, and delete methods plus caching, rate limiting, logging, and transient management for production APIs.
RESTful JSON API delivers posts and core WordPress content. User Plus adds everything your app needs on the user side — authentication, profiles, meta, SSO, BuddyPress social features, and user-owned content — without touching the parent plugin.
Native iOS, Android, React Native, or Flutter apps that need WordPress login, registration, profile data, and JWT sessions use User Plus as their direct app-user backend.
Claude, Codex, Gemini, Copilot, Grok, and other AI builders find one clear implementation path: install RESTful JSON API, add User Plus, call userplus/login, send Bearer, then use user endpoints.
Decouple your frontend from WordPress admin while keeping users, roles, meta, and account data in WordPress. Every user action returns clean, JSON-encoded responses.
PostsPlus controller gives User Plus its own post, CPT, taxonomy, and post-meta endpoints — separated from RESTful JSON API Pro’s authoritative posts/* to avoid collisions.
All three SSO providers verify tokens server-side, find or create the WordPress user, and return the same RESTful JSON API JWT response your app already handles.
Supports both web and native iOS flows. Verify Apple’s id_token server-side, find or create the user, return JWT.
GET /api/userplus/apple_request_auth/
POST /api/userplus/apple_connect/
apple_request_auth, handle callback, call apple_connect with the auth codeVerify Google’s id_token via Google’s tokeninfo endpoint. Audience checked against allowed Client IDs you configure.
POST /api/userplus/google_connect/
id_token via Google Sign-In SDKid_token to google_connectValidates the Facebook user access token via the debug_token endpoint using your App ID and App Secret.
POST /api/userplus/facebook_connect/
access_token to facebook_connectUser Plus 5.x is a clean rewrite — JWT-only, no cookies, no legacy auth cruft. Designed specifically for RESTful JSON API’s controller model.
Password auth with username or email. Returns a signed JWT with configurable lifetime (seconds param). HTTPS enforced by default.
Create new WordPress accounts with username, email, password, display name, first name, last name. Returns JWT immediately for app-ready registration flows.
Apps can validate a stored JWT and retrieve the authenticated user’s private profile in one call. Expired or invalid tokens return a clean 401 message.
Read public profiles by user ID or username. Read full private profile for authenticated user. Update display name, first name, last name, email, bio, and URL.
Get avatar URL for any user ID at configurable sizes. Returns Gravatar or custom WordPress avatar URL — ready for app image caching.
Authenticated users can change passwords by supplying their current password and a new one. Fresh JWT required after update for continued session access.
Read all custom meta for authenticated user, read a single key, write a single key-value pair, bulk-set many meta fields at once via custom_fields, delete individual meta keys. Protected system keys blocked automatically.
Find users by field (id, login, slug, email — email requires capability). List and search users with pagination, role filter, and count. Look up any user’s published posts by post type.
List all WordPress roles (requires list_users). Assign a role to any user (requires promote_users). Admins see full capability arrays in the roles list.
Authenticated users can permanently delete their own WordPress account. No admin required — designed for app account deletion flows required by Apple App Store and Google Play.
Check if an email or username already exists before registration — returns a clean boolean and user ID to power real-time form validation in your app.
The userplus/info endpoint returns plugin version, auth model, and active controllers — useful for app startup checks and AI agent discovery.
Get recent posts, paginated post lists, single posts, date-filtered posts, category posts, tag posts, and author posts — all supporting post_type for CPTs.
Discover public post types, list taxonomies, get terms in any taxonomy, get individual terms, get taxonomy posts, and list post terms. Full taxonomy discovery for app navigation.
Retrieve media items by type or MIME. List post attachments. Returns complete attachment data including sizes, URLs, caption, description, and alt text.
Create, update, and delete posts, pages, or CPTs with JWT auth. Supports taxonomies[], meta[] for ACF-style fields, attachment, image_url, and base64 image_data.
Get all custom meta for a post. Set a single post meta field. Delete individual meta keys. Full ACF-style app field support through WordPress post_meta.
Assign terms to a post (categories, tags, custom taxonomies). Create, update, and delete taxonomy terms — all JWT-protected with proper capability checks.
Retrieve comments for any post or CPT entry. Returns complete comment objects with author, date, content, and parent threading information.
Full BuddyPress controller is live in v5.0.4. Covers xProfile, members, activity stream, friends, private messages, notifications, and groups — all JWT-protected. Requires BuddyPress active with relevant components enabled.
Read all xProfile field groups and values for any user (xprofile_fields). Read the authenticated user’s full profile (xprofile). Update field values by ID or name (xprofile_update).
List BuddyPress members with type, search, and pagination filters, optionally including xProfile data (members). Get a single member’s full profile with xProfile (member).
Read the activity stream with component, type, and user filters. Post updates, delete activities and comments, add threaded comments, and add or remove activity favourites.
List confirmed friends, list pending friend requests, send a friend request, accept or reject a request by friendship or user ID, and remove an existing friendship. All JWT-protected.
List message threads (inbox or sentbox), read a full thread with sender profiles, send new messages or thread replies, mark threads read or unread, and get the unread message count.
List notifications with read/unread filter, get the unread count, mark a single notification read, and mark all notifications read in one call. All JWT-protected.
List groups with type and search filters, get a single group with full meta, list group members, join a group, and leave a group. List endpoints are public; join and leave require JWT.
buddypress/info returns plugin version, auth model, BuddyPress availability status (available or buddypress_missing), and all 7 endpoint groups — perfect for app startup component detection.
All tiers include the same complete feature set. Differences are domain count, support, and included development time.
One app or WordPress site
Single domain · 1 year updates & support
Secure PayPal checkout
Agencies with multiple client apps
Up to 5 domains · 2 years updates & priority support
Secure PayPal checkout
Agencies & product studios
Up to 10 domains · Future update access
Secure PayPal checkout
User Plus adds userplus/* and postsplus/* alongside RESTful JSON API’s own controllers. Pro remains authoritative over posts/* when active.
🔐 Auth, Profiles, Meta, SSO
Authentication and account endpoints for app-user workflows. Covers registration, login, token validation, profile read/write, user meta, bulk meta, user lookup, search, roles, account deletion, and all three SSO providers.
username or emailpassword · HTTPS requiredseconds — token lifetime (default: 1 day)usernameemailpassword — auto-generated if omitteddisplay_name, first_name, last_namedisplay_name, first_name, last_namenickname, description, user_urlemailkey or meta_key — returns single key if givencustom_fields or meta object.custom_fields or meta — key-value objectid, login, slug, or email. Email lookup requires JWT + list_users capability.field — id | login | slug | emailvalue📄 CPT Read + Write · Taxonomy · Media · Meta
Separated from RESTful JSON API Pro’s posts/* controller so the two don’t collide. PostsPlus gives User Plus licensees a full content API — read, write, taxonomy, and meta — while keeping Pro as the authoritative owner of posts/* when installed.
post_type, status, title, contenttaxonomies[taxonomy_name], categories, tagsmeta[field_name] for ACF-style fieldsattachment / featured_image file uploadimage_url, image_data (base64), featured_mediaid or post_idpost_idtaxonomy and terms[]🤝 33 Endpoints · v5.0.4 · Requires BuddyPress
Full BuddyPress API controller introduced in v5.0.4. Covers 7 component groups — all JWT-protected. Each component requires the corresponding BuddyPress component to be active. Returns a clean buddypress_missing status if BuddyPress is not installed.
user_id — defaults to current useruser_id — defaults to JWT userfields or xprofile — key-value objectuser_id — admins can update other userstype — active | newest | alphabetical | random | online | popular (default: active)count — per page, max 100 (default: 20)page — default 1search — search termxprofile — true to include xProfile datauser_id — defaults to JWT useruser_id, component, typeprimary_id, secondary_idpage, count, sort (ASC|DESC)comments — stream | threaded (default: stream)contentbp_moderate capability.activity_id or idparent_id.activity_id, contentparent_id — for threaded repliesbp_moderate.activity_id, comment_idactivity_id or iduser_id, xprofilefriend_id or user_idforce_accept — admins onlyfriendship_idfriend_id or user_idfriendship_idfriend_id or user_idfriend_id or user_idbox — inbox | sentbox (default: inbox)type — all | read | unread (default: all)page, count, searchthread_id or idcontent or messagerecipient_ids — for new threadthread_id — to replysubject — for new threadsthread_id or idthread_id or idis_new — true | false (omit for all)page, countnotification_id or idtype — active | newest | alphabetical | random | popular (default: active)page, count, searchgroup_id or idgroup_id or idpage, countgroup_id or idgroup_id or idUser Plus builds on RESTful JSON API’s foundation. Install parent first, then User Plus, activate license, configure SSO if needed, start building.
# Response: { “access_token”: “eyJ…”, “user_id”: 42 }
# 2. Get authenticated user profile
curl -H “Authorization: Bearer eyJ…” \
“https://example.com/api/userplus/me/”
# 3. Bulk-set user meta fields
curl -X POST “https://example.com/api/userplus/set_meta_many/” \
-H “Authorization: Bearer eyJ…” \
-d ‘{“custom_fields”:{“app_theme”:”dark”,”push_token”:”abc123″}}’
# 4. Google SSO
curl -X POST “https://example.com/api/userplus/google_connect/” \
-d “id_token=GOOGLE_JWT_ID_TOKEN”
// 2. Authenticated call
const me = await fetch(‘https://example.com/api/userplus/me/’, {
headers: { Authorization: `Bearer ${access_token}` }
});
// 3. Bulk user meta
await fetch(‘https://example.com/api/userplus/set_meta_many/’, {
method: ‘POST’,
headers: { Authorization: `Bearer ${access_token}`,
‘Content-Type’: ‘application/json’ },
body: JSON.stringify({ custom_fields: { theme: ‘dark’, locale: ‘en’ } })
});
// Authenticated call
final me = await http.get(
Uri.parse(‘https://example.com/api/userplus/me/’),
headers: { ‘Authorization’: ‘Bearer $token‘ },
);
// Google SSO
final sso = await http.post(
Uri.parse(‘https://example.com/api/userplus/google_connect/’),
body: { ‘id_token’: googleUser.idToken! },
);
User Plus replaces the old settings page with a clean, grouped admin interface — one tab per concern, no deprecated cookie or nonce-bypass settings.
Enter Apple Client ID (Services ID), Team ID, Key ID, and Private Key. Set the Redirect URI to match your Apple Services ID registration.
Enter comma-separated Allowed Google Client IDs. Leave blank only for early testing — production should restrict token audience to your app’s Client IDs.
Enter Facebook App ID and App Secret. Used for app-proof token validation via the Facebook Graph API debug_token endpoint.
Full endpoint docs built into the plugin settings. Covers every controller method, required and optional parameters, JWT usage, and sample calls — no external PDF needed.
One-click license activation and deactivation via the Software License Manager integration (Product ID 13). Toggle SSO registration and default role here.
A Settings link appears directly on the User Plus plugin row in Plugins → Installed Plugins for instant access without navigating admin menus.
The parent plugin never imports User Plus code. User Plus attaches its controllers using the json_api_controllers filter — the same extension point available to any companion plugin.
Every feature of User Plus is configurable from the WordPress admin without touching code. The Documentation tab replaces the old PDF with live in-plugin endpoint references.
This tab replaces the old PDF and external endpoint documentation. Cookie authentication is removed; protected endpoints require the RESTful JSON API JWT bearer token.
| Method | Endpoint | JWT Required | Notes | Example |
|---|---|---|---|---|
| POST | userplus/login | No | username or email + password | curl -d “username=u&password=p” /api/userplus/login/ |
| GET | userplus/me | Yes | Returns authenticated user’s private profile | -H “Authorization: Bearer JWT” /api/userplus/me/ |
| POST | userplus/google_connect | No | Google Settings configured | -d “id_token=GOOGLE_JWT” /api/userplus/google_connect/ |
| POST | userplus/set_meta_many | Yes | custom_fields or meta object | -d ‘{“custom_fields”:{“theme”:”dark”}}’ /api/userplus/set_meta_many/ |
| POST | postsplus/create_post | Yes | post_type, meta[], taxonomies[] | -d “post_type=product&title=X” /api/postsplus/create_post/ |
id_token via the Google Sign-In SDK, then POSTs it to userplus/google_connect. User Plus verifies it via oauth2.googleapis.com/tokeninfo and returns a JWT.debug_token.
What changed in v5.x and how User Plus fits alongside the free RESTful JSON API and Pro.
| Feature | Old JSON API User Plus (pre-v5) | RESTful JSON API Free | JSON API User Plus 5.x this product |
|---|---|---|---|
| JWT bearer authentication | ✗ | ✓ | ✓ |
| Cookie auth endpoints | ✓ (had these) | ✗ | ✗ Removed |
| userplus/login → JWT | ✗ | ✗ | ✓ |
| Registration + JWT response | ✗ | ✗ | ✓ |
| User meta CRUD | Partial | ✗ | ✓ Full + bulk |
| Apple Sign In | ✗ | ✗ | ✓ Web + native |
| Google Connect | ✗ | ✗ | ✓ id_token verify |
| Facebook Connect | fb_connect (legacy) | ✗ | ✓ Rebuilt — facebook_connect |
| CPT posts (postsplus/*) | Mixed into UserPlus | ✓ posts/* | ✓ Separated — postsplus/* |
| Post meta CRUD | ✗ | ✗ | ✓ |
| Taxonomy term CRUD | ✗ | ✗ | ✓ |
| Roles list + assign | ✗ | ✗ | ✓ |
| Account deletion endpoint | ✗ | ✗ | ✓ |
| In-plugin documentation tab | ✗ (PDF only) | ✓ | ✓ |
| BuddyPress — 33 endpoints | Partial (legacy) | ✗ | ✓ Full controller v5.0.4 |
| Coexists with RESTful JSON API Pro | Conflicts with posts/* | N/A | ✓ No collision |
User Plus gives Claude, Codex, Gemini, Copilot, Grok, and human developers one discoverable path to WordPress user management — no guessing which plugin handles auth, which handles profiles, which handles SSO.
Endpoint names follow a clear controller/method pattern. AI agents discover userplus/login, understand it returns a bearer token, and implement app auth flows without external documentation.
iOS apps using Swift or Objective-C, Android apps using Kotlin or Java, React Native and Flutter apps all use the same JWT flow: login → store token → send Bearer header → call endpoints.
Next.js, Nuxt, SvelteKit, Gatsby, or any JS framework can call User Plus from the server side. JWT sessions are fully stateless — no WordPress cookies or session management required.
Apple App Store and Google Play both require account deletion functionality. userplus/delete_account gives apps the backend endpoint they need for self-service deletion compliance.
Developer license (10 domains) lets agencies run User Plus across client installs. Each install gets its own license activation with independent SSO provider settings.
PostsPlus supports any public CPT as post_type. Apps for directories, listings, courses, events, recipes, jobs, properties, or bookings can read and write custom content through the same controller.
No. JSON API User Plus 5.x removed all cookie endpoints. generate_auth_cookie, validate_auth_cookie, generate_nopwd_cookie, and the legacy fb_connect endpoint are gone. All authentication now uses the RESTful JSON API JWT bearer token model — the same Authorization: Bearer ACCESS_TOKEN header pattern as the parent plugin.
You need the free RESTful JSON API plugin installed and active from WordPress.org. User Plus checks for it on activation and shows an admin notice if it’s missing. The parent plugin must also have its User controller enabled in Settings → Controllers for the userplus/* JWT infrastructure to work correctly.
No. PostsPlus uses postsplus/* specifically to avoid competing with Pro’s authoritative posts/* controller. When both User Plus and Pro are active, Pro remains the owner of posts/*. PostsPlus is a compatibility layer for User Plus licensees who need post-style endpoints without Pro, or who want both simultaneously without collision.
All three SSO providers follow the same pattern: your app gets a provider token (Apple’s auth code, Google’s id_token, Facebook’s access token), sends it to the corresponding User Plus SSO endpoint (apple_connect, google_connect, or facebook_connect), and User Plus verifies it server-side via the provider’s API. On success, User Plus finds or creates the WordPress user and returns the same JWT response your app gets from password login — so your app’s auth handling code is identical for all flows.
BuddyPress is fully supported in v5.0.4. The BuddyPress controller adds 33 JWT-protected endpoints across 7 component groups: xProfile (3), Members (2), Activity (7), Friends (6), Messages (6), Notifications (4), and Groups (5). Each group requires the corresponding BuddyPress component to be active. If BuddyPress is not installed, buddypress/info returns a buddypress_missing status instead of an error, so your app can handle it gracefully at startup.
Yes. userplus/delete_account permanently deletes the authenticated user’s WordPress account. This endpoint is specifically designed for App Store and Google Play self-deletion compliance requirements. It requires a valid JWT for the account being deleted — other users’ accounts cannot be deleted through this endpoint.
User Plus blocks internal WordPress and WooCommerce meta keys including session_tokens, user_pass, _wp_capabilities, wp_capabilities, wp_user_roles, wp_user_level, and similar security-sensitive keys. Custom meta keys you create for app use (like app_theme, push_token, onboarding_completed) are fully accessible through set_meta, meta, and set_meta_many.
Contact us for specifics on your license tier. Development and staging environments are generally handled on a case-by-case basis. The Developer tier (10 domains) is usually sufficient for agencies running multiple client projects plus internal dev/staging environments. Business (5 domains) is appropriate for smaller agency setups.
Whether you’re evaluating User Plus for a new app, migrating from the old cookie-based plugin, or need custom endpoint development — we can help.
Describe your WordPress setup, the app platform (iOS, Android, Flutter, web), SSO requirements, and whether you need User Plus alone or alongside RESTful JSON API Pro.
JSON API User Plus 5.x is the only plugin you need for WordPress app authentication, user profiles, Apple/Google/Facebook SSO, user meta, and CPT app content. No cookies. No legacy auth. No conflicts with Pro.
