/ Plugin Category

/ Developer Tools & Customization

/ API & Webhook Integration

/ WP REST API – OAuth 1.0a Server

WP REST API – OAuth 1.0a Server

By Joe Hoyle

Developer Tools & Customization / API & Webhook Integration

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

WP REST API – OAuth 1.0a Server Review - In-Depth Analysis

Connect applications to your WordPress site without giving away your password. This plugin uses OAuth 1.0a for delegated authorization.

Performance Overview

WPS Score

6.82/10

User Rating

3.7/5 (based on 7+ reviews)

Active Installations

8,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin uses the OAuth 1.0a protocol to allow delegated authorization; that is, to allow applications to access a site using a set of secondary credentials. This allows server administrators to control which applications can access the site, as well as allowing users to control which applications have access to their data.

This plugin only supports WordPress >= 4.4.

We strongly recommend you use an existing OAuth library. You will be best off if you understand the authorization process, but leave the actual implementation to well-tested libraries, as there are a lot of edge cases.

If you already know how to use OAuth, here is the lowdown: The plugin uses OAuth 1.0a in a three-legged flow. Your callback URL must match the registered callback URL for the application in the scheme, authority (user/password) host, port, and path sections. The only signature method supported is HMAC-SHA1.

Comparing to Alternatives

WP REST API – OAuth 1.0a Server is a plugin designed to secure API calls using OAuth 1.0a, with JWT Authentication for WP REST API being a notable alternative.

Top alternatives

JWT Authentication for WP REST API ( WPS: 7)

Strengths

Provides OAuth 1.0a authentication for REST API calls.
Has a user base that finds it effective for securing API calls.
No known security vulnerabilities reported.
Supports creating applications with consumer keys and callbacks.
Free to use without a paid version.

Weaknesses

Authentication issues reported by some users.
Lack of developer response to support queries.
Some users report missing parameters causing failures.
Applications created may be deleted automatically after some time.

User Sentiment Analysis

With a rating of 3.7 out of 5 based on 7 reviews, user sentiment is mixed, showing both appreciation for functionality and frustration with support and reliability.

Positive highlights

"Worked like a charm!" - Rehmat Alam
"Really Useful And Good Plugin" - Ahmed Hnewa
"Very good plugin, please update." - springapidev
"Automatically delete application" - mphramin (noted issue but engaged with plugin)

Common complaints

Fails to authenticate users properly causing 401 errors.
Developer support is unresponsive on forums and GitHub.
Missing required parameters like oauth_token causing failures.

Weaknesses

Inconsistent authentication performance.
Poor support and documentation.
Issues with application persistence over time.

Who Should Use This?

Best for

Users who need OAuth 1.0a authentication for their WordPress REST API and are comfortable troubleshooting or have development experience.

Not ideal for

Users seeking reliable, fully supported authentication plugins or those who require prompt developer support and comprehensive documentation.

Pricing & Value

Free version includes

The free version provides OAuth 1.0a authentication capabilities for the WordPress REST API without any paid upgrade options.

Final Verdict

WP REST API – OAuth 1.0a Server offers a useful OAuth 1.0a authentication method for securing REST API calls, with no known security vulnerabilities and a free, fully functional version. However, it suffers from inconsistent authentication success and a lack of developer support, which may hinder users needing reliable and responsive assistance.

While it can be a good choice for technically skilled users who can manage its quirks, others might prefer alternatives like JWT Authentication for WP REST API that may offer better support and stability. Overall, it provides value but with notable limitations to consider.