> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cocartapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setup

> Learn how to setup JWT Authentication for CoCart.

<Info>
  Make sure you have downloaded the [JWT Authentication for CoCart](https://wordpress.org/plugins/cocart-jwt-authentication/) plugin and installed it.
</Info>

## Secret Key Configuration

Add the following code to your **wp-config.php** file:

```php theme={"system"}
define( 'COCART_JWT_AUTH_SECRET_KEY', 'YOUR-UNIQUE-SECRET-KEY' );
```

<Warning>
  Never share or commit your secret key. Keep it secure and unique for each environment.
</Warning>

## Enable PHP HTTP Authorization Header

### Shared Hosts

Most shared hosting providers have disabled the **HTTP Authorization Header** by default.

To enable this option you'll need to edit your **.htaccess** file by adding the following:

```apache theme={"system"}
RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
```

or

```apache theme={"system"}
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
```

### WPEngine

To enable this option you'll need to edit your **.htaccess** file by adding the following outside of IfModule:

```apache theme={"system"}
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
```

Example of what that looks like.

```apache theme={"system"}
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
</IfModule>

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
# END WordPress
```

## How It Works

CoCart JWT Authentication implements a secure OAuth 2.0 compliant authentication flow. Here's how the authentication process works in your WordPress application:

<Steps>
  <Step title="Authentication Request">
    Client authenticates the login endpoint via Authorization header using the basic method to obtain JWT tokens.
  </Step>

  <Step title="Token Usage">
    Use the JWT token to authenticate any REST API requests via Authorization header using bearer method.
  </Step>

  <Step title="Token Refresh">
    Use refresh token to obtain new access tokens without re-authentication via the refresh-token endpoint.
  </Step>

  <Step title="Validate Token">
    Validate the token in the background of your application from time to time to check the users authentication session is still valid.
  </Step>
</Steps>

## Security Best Practices

CoCart JWT Authentication comes with built-in security features to protect your WordPress application. Here are the key security measures you should be aware of:

<Check>Automatic token revocation on password/email changes.</Check>
<Check>Automatic token revocation on user deletion.</Check>
<Check>Automatic token revocation on user logout.</Check>
<Check>Configurable token expiration times.</Check>
<Check>Secure refresh token rotation.</Check>