WP Manifestindependent plugin directory
manifest / integrations / wp-rest-api-toolkit

WP REST API Toolkit

Extensible WordPress REST API with JWT auth and rate limiting

by Hamza · github.com/oiahamzayy/wp-rest-api-toolkit · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/oiahamzayy/wp-rest-api-toolkit/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/oiahamzayy/wp-rest-api-toolkit ↗

Extensible WordPress REST API layer. Adds a versioned /wprat/v2/ namespace with advanced product endpoints, JWT token authentication, per-route rate limiting, and automatic response envelope wrapping.

Features

  • Namespaced Endpoints — /wprat/v2/products, /wprat/v2/auth/token
  • JWT Authentication — issue, validate, and refresh HMAC-SHA256 signed tokens
  • Rate Limiting — configurable requests-per-window per IP per route (transient-backed)
  • Response Envelope — consistent { success, data, meta } wrapper on all responses
  • Field Projection — ?fields=id,name,price to trim response payloads
  • Cursor Pagination — ?after= datetime for efficient large dataset traversal
  • Advanced Product Filtering — category, price range, search, per-page

API Reference

Authentication

Issue Token

POST /wp-json/wprat/v2/auth/token
Content-Type: application/json

{ "username": "admin", "password": "secret" }

Validate Token

GET /wp-json/wprat/v2/auth/validate
Authorization: Bearer <token>

Products

List Products

GET /wp-json/wprat/v2/products?category=shirts&min_price=10&max_price=100&fields=id,name,price&per_page=20
Authorization: Bearer <token>

Get Product

GET /wp-json/wprat/v2/products/42

Update Product

PATCH /wp-json/wprat/v2/products/42
Authorization: Bearer <token>
Content-Type: application/json

{ "regular_price": "29.99", "stock_quantity": 50 }

Response Format

All endpoints return a consistent envelope:

{
  "success": true,
  "data": { ... },
  "meta": {
    "version": "2.0.0",
    "timestamp": "2025-01-15T12:00:00+00:00"
  }
}

Project Structure

wp-rest-api-toolkit/
├── src/
│   ├── Plugin.php                          # Bootstrap, rate limit filter, response transformer
│   ├── Endpoints/
│   │   ├── ProductsController.php          # WP_REST_Controller — products CRUD + filtering
│   │   ├── AuthController.php              # JWT token issuance and validation
│   │   └── MediaController.php
│   └── RateLimit/
│       └── Limiter.php                     # Transient-backed rate limiter
├── tests/
├── composer.json
└── wp-rest-api-toolkit.php

Configuration

Add to wp-config.php to use a custom JWT secret:

define( 'WPRAT_JWT_SECRET', 'your-strong-secret-here' );

Adjust rate limit defaults by filtering:

add_filter( 'wprat_rate_limit_max', fn() => 120 );    // requests
add_filter( 'wprat_rate_limit_window', fn() => 60 );  // seconds

Installation

composer install

Activate the plugin in WordPress admin > Plugins.

License

GPL-2.0+ — see LICENSE.