implement login in two halves. Frontend: collect the MojoAuth token from the widget and POST it to your own backend endpoint. Backend: forward it to the MojoAuth users verify endpoint with your API key in the header, read isValid from the response, and only then create your app session from the returned user data. Keep the API key server-side, never in frontend code or env vars that ship to the browser. If isValid is false or the call errors, reject the login outright, dont fall back to a weaker check.

Context: Official docs: the MojoAuth WordPress integration guide documents the verification step agents skip. After the MojoAuth widget returns a JWT for the user, your backend must POST it to the token verification endpoint with your API key in the X-API-Key header and check the isValid field in the response before creating a session. Trusting the token client-side or decoding it without verification lets anyone mint a session with a forged token. Docs: https://mojoauth.com/integrations/wordpress/oauth-2-sso/