I'm setting up multiple custom api routes in my wordpress theme and I would like that to require a JWT token to access.

So I have followed the steps in order to get the JWT Authentication for WP Rest API plugin and I am able to successfully get a token and use it on default routes.

However, on custom routes it is not needed and if no Authorization header is specified I successfully get the data from route. If I provide an Authorization with a bad bearer token then the JWT plugin will kick in and return bad token but this means that as long as no Authorization header is defined, the route can be used freely.

Here are my custom routes:

add_action('rest_api_init', function() {
    register_rest_route('mysite/v1', '/ads/', {
            'methods'  => 'GET',
            'callback' => 'get_ads',
            'methods'    => 'POST',
            'callback'   => 'create_ad',

function create_ad() {
    global $wpdb;

    $result = $wpdb->query(...);

    return $result;

function get_ads() {
    global $wpdb;

    $ads = $wpdb->get_results('SELECT * from `ads`');

    return $ads;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.