# JWT Authentication for WP REST API
**URL:** https://community.kinsta.com/t/jwt-authentication-for-wp-rest-api/2385
**Category:** Application Support
**Created:** [July 23, 2023, 8:05pm UTC](https://community.kinsta.com/t/jwt-authentication-for-wp-rest-api/2385 "2023-07-23T20:05:15Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ruzicic](https://community.kinsta.com/u/ruzicic)
#### Post date: [July 23, 2023, 8:05pm UTC](https://community.kinsta.com/t/jwt-authentication-for-wp-rest-api/2385/1 "2023-07-23T20:05:15Z")
Hello DevKinsta Community,
I’m having an issue with JWT authentication for the WP REST API in a local development environment set up through DevKinsta. I am using the WPGraphql plugin and trying to make several GraphQL requests from a local Node.js app. The requests work correctly in the internal WPGraphQL IDE but fail when made from the Node.js app. I suspect this is due to the authentication headers not being passed correctly in the request.
When making the request, the response I receive is full of null values, as if the request is not authenticated, though the token used has admin permissions and works correctly when used in the internal WPGraphQL IDE. I have tried using both the `fetch` and `axios` libraries for making requests but encounter the same issue with both.
After some research, I came to the conclusion that I need to set the following in my Nginx configuration to enable the `Authorization` header:
```auto
proxy_set_header Authorization $http_authorization;
proxy_pass_header Authorization;
```
However, when adding these to the server block for my site in the `.conf` file, I still encounter the same issue.
Has anyone encountered a similar issue or can provide any guidance on how to correctly pass the `Authorization` header in requests made from a Node.js app to a WordPress site hosted through DevKinsta?
---
### Author:  [@Alessandro](https://community.kinsta.com/u/Alessandro)
#### Post date: [July 24, 2023, 11:01am UTC](https://community.kinsta.com/t/jwt-authentication-for-wp-rest-api/2385/3 "2023-07-24T11:01:19Z")
Hi @ruzicic and welcome to Kinsta Community!
I’ve no experience with it, but I wonder if Nginx is hiding the header 🤔 does adding the following line make any difference?
fastcgi\_pass\_header Authorization;
Regards,
Alessandro
---
### Author:  [@ruzicic](https://community.kinsta.com/u/ruzicic)
#### Post date: [July 24, 2023, 8:16pm UTC](https://community.kinsta.com/t/jwt-authentication-for-wp-rest-api/2385/4 "2023-07-24T20:16:33Z")
Thanks for throwing ideas, @Alessandro !
> [@Alessandro](#):
>
> I wonder if Nginx is hiding the header 🤔 does adding the following line make any difference?
>
> fastcgi\_pass\_header Authorization;
Tested - it didn’t help.
All I have to work with are these `null` fields. Wondering if there’s an easy way to debug into this, as it could be so many different things. Feels like a long journey, as I started going through docker containers behind DevKinsta 😂
Maybe I should reach out to Kinsta support, as I have the same issue in production. 🤔
---
### Author:  [@Agus](https://community.kinsta.com/u/Agus)
#### Post date: [July 25, 2023, 3:34am UTC](https://community.kinsta.com/t/jwt-authentication-for-wp-rest-api/2385/5 "2023-07-25T03:34:06Z")
Heya there @ruzicic 👋
Thank you for your reply and update.
I don’t don’t have experiences with it either 😅 and as I far as I could see, that header:
> fastcgi\_pass\_header Authorization;
seems to be used by the jwt-auth plugin as well as mentioned [here](https://wordpress.org/support/topic/403-jwt_auth_no_auth_header-with-nginx-kinsta/) - and it was also suggested [here](https://github.com/Tmeister/wp-api-jwt-auth/issues/194) (which seems to be equivalent to the [.htaccess rule mentioned in the " JWT Authentication for WP REST API" plugin’s description/doc](https://wordpress.org/plugins/jwt-authentication-for-wp-rest-api/#description:~:text=SetEnvIf%20Authorization%20%22(.*)%22%20HTTP_AUTHORIZATION%3D%241))
but you tested it already and it didn’t help 🤔
I also tried to search further and found [this](https://github.com/usefulteam/jwt-auth/issues/61) custom NGINX rule.
Though I’m not sure if that would work properly as expected, maybe you can give it a try and test on your local computer again?
On your initial post, you mentioned:
> When making the request, the response I receive is full of null values, as if the request is not authenticated, though the token used has admin permissions and works correctly when used in the internal WPGraphQL IDE.
I’m not quite sure what the exact request command you tried there, and the actual messages/values returned.
I would suggest, maybe you may want to check the file: _yoursitename\_access.log_ (inside the `~/DevKinsta/logs` subfolder) and try to tailing that log file while you’re making the request, and see if anything logged in there (and perhaps to check and compare them, both when you’re making the requests from WPGraphQL IDE that requests work correctly vs making the same requests from your local Node.js app)?
> Maybe I should reach out to Kinsta support, as I have the same issue in production.
If it’s still not working properly as expected, we would recommend to reach out to the plugin’s support team perhaps - in case they can suggest the proper/correct NGINX rule to be setup, so that our support team can also try to apply the same required NGINX custom rule on the server side and see if that will help to solve the issue on your production site.
Regards,
Agus