Best API key plugins for WordPress
The most popular API key plugins for WordPress in November 2026, in WordPress.org’s own popular order, which follows active installs. JWT Authentication for WP REST APIs leads with 10K+ active installs, ahead of PKL WPz REST API Authentication (20+) and WP REST API Key Authentication (10+). All 4 plugins tagged “API key” are below, with figures from WordPress.org that update every day.
Installs aren’t everything: a recent release, a “Tested up to” that matches the current WordPress, and support threads that get resolved show a plugin is looked after. Open any plugin for its downloads, rank history and alternatives.
Research this niche or see all plugins.
Top 4 API key plugins
- 1.
JWT Authentication for WP REST APIsThe most installed API key plugin, with 10K+ active installs. Rated 4.4 from 75 reviews, updated 4 weeks ago.
- 2.
PKL WPz REST API Authentication20+ active installs. No reviews yet, updated 1 month ago.
- 3.
WP REST API Key Authentication10+ active installs. No reviews yet, last updated 1 year ago. Tested only up to WordPress 6.7.11.
- 4.
DRSiteFewer than 10 active installs. No reviews yet, updated 2 weeks ago.
All 4 plugins tagged “API key”

JWT Authentication for WP REST APIs
Down in the last 7 days:8#1,479by miniOrange29 days ago
Secure and protect WordPress REST API from unauthorized access using JWT token, Basic Authentication, API Key, OAuth 2, or external token.
- Installs
- 10K+
- Rating
- 4.4(75)
- Downloads
- 173/day

PKL WPz REST API Authentication
#26,655by Palmiiz Kittinan1 month ago
Control WordPress REST API access by requiring user authentication with API key system.
- Installs
- 20+
- Rating
- –
- Downloads
- 0/day

WP REST API Key Authentication
Up in the last 7 days:67#31,102by Kamal Hosen1 year ago
A simple plugin to add API key-based authentication to the WordPress REST API. Manage multiple API keys and secure your REST API endpoints.
- Installs
- 10+
- Rating
- –
- Downloads
- 0/day

DRSite
Up in the last 7 days:11,302#56,048by drsiteapp14 days ago
Asks for an API key on first run, then creates a restorable ZIP (wp-content + database.sql + manifest).
- Installs
- <10
- Rating
- –
- Downloads
- 0/day