Configuration
Authentication Tokens
What are Authentication Tokens?
MCP authentication tokens are secure, temporary credentials that allow external MCP clients to the WordPress MCP server
These tokens are implemented using JWT (JSON Web Tokens), providing secure and stateless authentication.
How They Work
- Tokens are generated with your current user permissions and expire automatically
- They provide access to MCP route endpoints for your WordPress content
- Each token is unique and can be revoked individually if compromised
- Tokens automatically inherit your user role and capabilities
Security Best Practices
- Never share tokens in public repositories, emails, or chat messages
- Use the shortest expiration time that meets your needs
- Revoke tokens immediately if you suspect they may be compromised
- Regularly review and clean up unused or expired tokens
- Should only be used in highly controlled environments
- Must be manually revoked if compromised
- Consider using long-lived tokens (24 hours) instead
- Regularly audit and rotate never-expiring tokens
These tokens are exclusively for MCP protocol access (stdio and streamable/HTTP). They will not work with WordPress REST API endpoints or other authentication systems.
Remember: These tokens provide access based on your user permissions. If you can see it in WordPress, applications using your token can see it too.
Generate tokens below to allow secure access to your WordPress content through the MCP protocol.
Token Limmit
Maximum 10 active tokens allowed per user. When generating a new token at the limit, oldest revoked tokens will be automatically removed to make room. If no revoked tokens exist, new token generation will be blocked - you must revoke some existing active tokens first.
Token Duration
Your Active Tokens
| User | Issued At | Expires At | Status | Actions |
|---|---|---|---|---|
| wpuser | Aug 10, 2026, 4:37:36 PM | Never expires | Active (Never expires) | |
| wpuser | Aug 10, 2025, 5:44:46 PM | Never expires | Active (Never expires) | |
| wpuser | Aug 13, 2025, 1:15:18 PM | Aug 13, 2025, 2:15:18 PM | Active | |
| wpuser | Aug 13, 2025, 1:16:11 PM | Aug 13, 2025, 7:16:11 PM | Revoked |