WP OAuth Server (OAuth Authentication)
Adds Authentication through OAuth 2. Provides the ability for Single Sign On for websites & Mobile Applications.
Use with caution
WP OAuth Server (OAuth Authenti… works, but test it on a staging site before relying on it in 2026. It runs on 3K+ sites, is rated 3.8/5 and was last updated 3 days ago, and scores 59/100 on our health check.
- Actively developed — last update 3 days ago
- Momentum — downloads up 17.3% vs the previous 30 days
- Only tested up to WordPress 6.9 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where WP OAuth Server (OAuth Auth… stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| oauth | #5 |
| OAuth provider | #3 |
| oauth2 | #2 |
| OAuth2 Service | #1 |
| Provider | #16 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 3.8 from 41 reviews
About WP OAuth Server (OAuth Authentication)
From the official readme · v4.5.2Description
Connect your app to WordPress or use SSO to connect multiple websites with the same username and passwords. No 3rd party servers are needed with WP OAuth Server. Everything you need is in this plugin.
Features
- WP REST API Authentication. Provides ability to make authorized calls to protected REST API endpoints.
- WP REST API Lock Down. Prevent any calls to the REST API unless authorized
- Unlimited OAuth 2.0 Clients
- Support for Implicit Flow
- Built-In Resource Server
- Automated Authorization Flow (User does not have to see authorization screen)
- Easily Extend/ Modify the Endpoints
- OAuth 2.0 PKCE
- Modern and Legacy JWT authorization support. OAuth 2.0 JSON Web Token Support
Supported Grant Types
- Authentication Code w/Implicit
- User Credentials (Pro)
- Client Credentials (Pro)
- Refresh Token (Pro)
- OpenID Connect (Pro)
- OpenID Discovery
- Public Clients (Pro)
- Public Client Proof of Key Exchange (PKCE)
Supports
- Connecting any Custom Mobile and Desktop Application to WordPress’s Backend.
- Any software or web platform utilizing OAuth 2.0.
- Allows RocketChat to use WordPress as a Backend.
- Connects Moodle LMS and use WordPress users.
- Alexa Skills Authentication
- Tribe.so Community OAuth 2 SSO Support
How to Use
Visit https://wp-oauth.com/support/documentation/ for detailed documentation on installing, configuring and using
WordPress OAuth Server.
Licensing
WP OAuth Server is free to use. Please support the project by licensing. You can view more information at
https://wp-oauth.com.
Minimum Requirements
- PHP 5.6.4 or greater (latest version recommended)
- OpenSSL installed and enabled if you plan on using OpenID Connect
Other Information
- NOTE: As of 3.0.0, there are no backward compatibility for any version older than 3.0.0
- NOTE: Due to IIS’s inability play nice, WP OAuth Server may work but is very limited for Windows OS.
Support
Support requests should be made by opening a support request at https://wp-oauth.com/support/submit-ticket/.
Installation
- Upload
oauth-providerto the/wp-content/plugins/directory or use the built in plugin install by WordPress - Activate the plugin through the ‘Plugins’ menu in WordPress
- Click ‘Settings’ and then ‘permalinks’. Then simply click ‘Save Changes’ to flush the rewrite rules so that OAuth2 Provider
- You’re Ready to Rock
Frequently asked questions
Do I need OAuth2 or App Passwords?
This depends. If you project requires random users access an application, then OAuth2 is the route you need. If you are making a server that handles a one time client id and secert for authorization, then Application Passwords is for you.
How do I add a APP/Client?
Click on Settings->OAuth Server. Click on the Clients tab and then Add New Client. Enter the client information and your are done.
Does WordPress OAuth Server Support SSO (Single Sign On)
Yes, WordPress OAuth Server does support Single Sign On for both Traditional OAuth2 Flow and OpenID Connect.
Is there support for this plugin? Can you help me?
You can visit our https://wp-oauth.com/support/submit-ticket/ to open up a support request directly with developers.
Can you set this up for me on my current website?
DRINKS COFFEE * Can I? “YES”. You are more than welcome to contact us with if you should ever need assistance.
How do I use WordPress OAuth Server?
You can visit https://wp-oauth.com/support/documentation/. You will find in-depth documentation as well as examples of how to get started.
Changelog
Version 2.0.0 and lower are not compatible with version 3.0.0. If you have built your service using version 2.0.0 or lower, visit https://wp-oauth.com/support/submit-ticket/ to open a new request support request. For any upgrade or modification, PLEASE PLEASE PLEASE make a full backup of your data.
4.5.2
- Security Update: Fixed a Contributor-to-Administrator stored XSS via unescaped
client_idmeta on the OAuth clients admin table. Updating is highly recommended. - Hardened
wo_clientpost type capabilities so only administrators can create or edit OAuth clients through core APIs (including XML-RPC). - Protected OAuth client post meta (
client_id,client_secret,redirect_uri,grant_types,user_id,scope) from unauthorized custom-fields writes. - Hardened user-generated profile token clients so they remain available to logged-in users without allowing arbitrary client meta.
4.5.1
- Security Update: Scoped the revoke-token AJAX nonce to a named action so a generic default-action nonce cannot be reused. Updating is recommended.
- Fixed Generate/Regenerate Token nonce fields on the user profile so those actions submit a valid nonce.
4.5.0
- Security Update: A patch has been added to protect the private key during certain server configurations. Updating is highly recommended.
- Added a new admin notice for permalink setting recommendations.
- Updated with WP 6.9 and up to PHP 8.5.0.
4.4.0
- (Security Update) Refactored the “destroy” endpoint to remove the auto redirect in favor for a manual checkpoint.
- Cleaned up misc functions. This should not effect any existing implementations.
- Tested with 6.4 installed.
4.3.4
- Updated to fix deprecated messages for PHP 8.1 and WP 6.2
- Added prepare statements in CRON cleanup
- Adjustments to make some options more clear.
4.3.3
- Updated
wpoauth_authenicate_bypassto return false. - Tested with WP 6.2
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best WP OAuth Server (OAuth Authen… alternatives
All oauth plugins →
FAQ
WP OAuth Server (OAuth Authenticati…: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Sep 27, 2026
Is WP OAuth Server (OAuth Authenti… free?
Yes. WP OAuth Server (OAuth Authenti… is free to download and use from the official WordPress.org plugin directory.
Is WP OAuth Server (OAuth Authenti… safe to use in 2026?
WP OAuth Server (OAuth Authenti… works, but test it on a staging site before relying on it in 2026. It runs on 3K+ sites, is rated 3.8/5 and was last updated 3 days ago, and scores 59/100 on our health check.
How many websites use WP OAuth Server (OAuth Authenti…?
WP OAuth Server (OAuth Authenti… is active on 3K+ WordPress websites and has been downloaded 188,858 times since it launched in March 2013. It was downloaded 4,612 times in the last 30 days.
Does WP OAuth Server (OAuth Authenti… work with WordPress 7.1?
WP OAuth Server (OAuth Authenti… is officially tested up to WordPress 6.9.0, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
What PHP version does WP OAuth Server (OAuth Authenti… need?
WP OAuth Server (OAuth Authenti… requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was WP OAuth Server (OAuth Authenti… last updated?
The latest version, 4.5.2, was released on September 24, 2026 (3 days ago).
Who makes WP OAuth Server (OAuth Authenti…?
WP OAuth Server (OAuth Authenti… is developed and maintained by Jayson T Cote.
What are the best alternatives to WP OAuth Server (OAuth Authenti…?
The most popular alternatives to WP OAuth Server (OAuth Authenti… are JWT Authentication for WP R… (60K+ installs), Gmail SMTP (10K+ installs) and Login for Google Apps (10K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
