{"id":15739691,"url":"https://github.com/kreait/firebase-tokens-php","last_synced_at":"2025-04-12T20:38:21.320Z","repository":{"id":44734396,"uuid":"80968505","full_name":"kreait/firebase-tokens-php","owner":"kreait","description":"A PHP library to work with Firebase tokens","archived":false,"fork":false,"pushed_at":"2025-01-27T06:34:31.000Z","size":532,"stargazers_count":231,"open_issues_count":0,"forks_count":33,"subscribers_count":4,"default_branch":"5.x","last_synced_at":"2025-04-05T19:06:47.489Z","etag":null,"topics":["firebase","firebase-tokens","jwt","php","php-library","php7"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kreait.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"jeromegamez","tidelift":"packagist/gamez/duration"}},"created_at":"2017-02-05T04:26:36.000Z","updated_at":"2025-02-23T13:46:58.000Z","dependencies_parsed_at":"2023-11-20T23:33:49.897Z","dependency_job_id":"93e89ee3-1c45-4c80-a637-8a9504429833","html_url":"https://github.com/kreait/firebase-tokens-php","commit_stats":{"total_commits":233,"total_committers":11,"mean_commits":"21.181818181818183","dds":0.08154506437768239,"last_synced_commit":"df6f9d153f3bbe671c3247576d2a45cbd0a79620"},"previous_names":[],"tags_count":50,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kreait%2Ffirebase-tokens-php","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kreait%2Ffirebase-tokens-php/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kreait%2Ffirebase-tokens-php/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kreait%2Ffirebase-tokens-php/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kreait","download_url":"https://codeload.github.com/kreait/firebase-tokens-php/tar.gz/refs/heads/5.x","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248631668,"owners_count":21136554,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["firebase","firebase-tokens","jwt","php","php-library","php7"],"created_at":"2024-10-04T02:06:05.892Z","updated_at":"2025-04-12T20:38:21.302Z","avatar_url":"https://github.com/kreait.png","language":"PHP","funding_links":["https://github.com/sponsors/jeromegamez","https://tidelift.com/funding/github/packagist/gamez/duration"],"categories":[],"sub_categories":[],"readme":"# Firebase Tokens\n\nA library to work with [Google Firebase](https://firebase.google.com) tokens. You can use it to \n[create custom tokens](https://firebase.google.com/docs/auth/admin/create-custom-tokens) and \n[verify ID Tokens](https://firebase.google.com/docs/auth/admin/verify-id-tokens).\n\nAchieve more with the [Firebase Admin SDK](https://github.com/kreait/firebase-php) for PHP (which uses this library).\n\n[![Current version](https://img.shields.io/packagist/v/kreait/firebase-tokens.svg)](https://packagist.org/packages/kreait/firebase-tokens)\n[![Supported PHP version](https://img.shields.io/packagist/php-v/kreait/firebase-tokens.svg)]()\n[![Monthly Downloads](https://img.shields.io/packagist/dm/kreait/firebase-tokens.svg)](https://packagist.org/packages/kreait/firebase-tokens/stats)\n[![Total Downloads](https://img.shields.io/packagist/dt/kreait/firebase-tokens.svg)](https://packagist.org/packages/kreait/firebase-tokens/stats)\n[![Tests](https://github.com/kreait/firebase-tokens-php/workflows/Tests/badge.svg)](https://github.com/kreait/firebase-tokens-php/actions)\n[![Sponsor](https://img.shields.io/static/v1?logo=GitHub\u0026label=Sponsor\u0026message=%E2%9D%A4\u0026color=ff69b4)](https://github.com/sponsors/jeromegamez)\n\n---\n\n## The future of the Firebase Admin PHP SDK\n\nPlease read about the future of the Firebase Admin PHP SDK on the\n[SDK's GitHub Repository](https://github.com/kreait/firebase-php).\n\n---\n\n- [Installation](#installation)\n- [Simple Usage](#simple-usage)\n  - [Create a custom token](#create-a-custom-token)\n  - [Verify an ID token](#verify-an-id-token)\n  - [Verify a Session Cookie](#verify-a-session-cookie)\n  - [Tokens](#tokens)\n  - [Tenant Awareness](#tenant-awareness) \n- [Advanced Usage](#advanced-usage)\n  - [Cache results from the Google Secure Token Store](#cache-results-from-the-google-secure-token-store)\n- [Supported Versions](#supported-versions)\n\n## Installation\n\n```bash\ncomposer require kreait/firebase-tokens\n```\n\n## Simple usage\n\n### Create a custom token\n\nMore information on what a custom token is and how it can be used can be found in \n[Google's official documentation](https://firebase.google.com/docs/auth/admin/create-custom-tokens).\n\n```php\n\u003c?php\n\nuse Kreait\\Firebase\\JWT\\CustomTokenGenerator;\n\n$clientEmail = '...';\n$privateKey = '...';\n\n$generator = CustomTokenGenerator::withClientEmailAndPrivateKey($clientEmail, $privateKey);\n$token = $generator-\u003ecreateCustomToken('uid', ['first_claim' =\u003e 'first_value' /* ... */]);\n\necho $token;\n// Output: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.e...\n```\n\n### Verify an ID token\n\nThe ID token verification methods included in the Firebase Admin SDKs are meant to verify \nID tokens that come from the client SDKs, not the custom tokens that you create with the Admin SDKs. \nSee [Auth tokens](https://firebase.google.com/docs/auth/users/#auth_tokens) for more information.\n\n```php\n\u003c?php\n\nuse Kreait\\Firebase\\JWT\\Error\\IdTokenVerificationFailed;\nuse Kreait\\Firebase\\JWT\\IdTokenVerifier;\n\n$projectId = '...';\n$idToken = 'eyJhb...'; // An ID token given to your backend by a Client application\n\n$verifier = IdTokenVerifier::createWithProjectId($projectId);\n\ntry {\n    $token = $verifier-\u003everifyIdToken($idToken);\n} catch (IdTokenVerificationFailed $e) {\n    echo $e-\u003egetMessage();\n    // Example Output:\n    // The value 'eyJhb...' is not a verified ID token:\n    // - The token is expired.\n    exit;\n}\n\ntry {\n    $token = $verifier-\u003everifyIdTokenWithLeeway($idToken, $leewayInSeconds = 10000000);\n} catch (IdTokenVerificationFailed $e) {\n    print $e-\u003egetMessage();\n    exit;\n}\n```\n\n### Verify a Session Cookie\n\nSession cookie verification is similar to ID Token verification.\n\nSee [Manage Session Cookies](https://firebase.google.com/docs/auth/admin/manage-cookies) for more information.\n\n```php\n\u003c?php\n\nuse Kreait\\Firebase\\JWT\\Error\\SessionCookieVerificationFailed;\nuse Kreait\\Firebase\\JWT\\SessionCookieVerifier;\n\n$projectId = '...';\n$sessionCookie = 'eyJhb...'; // A session cookie given to your backend by a Client application\n\n$verifier = SessionCookieVerifier::createWithProjectId($projectId);\n\ntry {\n    $token = $verifier-\u003everifySessionCookie($sessionCookie);\n} catch (SessionCookieVerificationFailed $e) {\n    echo $e-\u003egetMessage();\n    // Example Output:\n    // The value 'eyJhb...' is not a verified ID token:\n    // - The token is expired.\n    exit;\n}\n\ntry {\n    $token = $verifier-\u003everifySessionCookieWithLeeway($sessionCookie, $leewayInSeconds = 10000000);\n} catch (SessionCookieVerificationFailed $e) {\n    print $e-\u003egetMessage();\n    exit;\n}\n```\n\n### Tokens\n\nTokens returned from the Generator and Verifier are instances of `\\Kreait\\Firebase\\JWT\\Contract\\Token` and\nrepresent a [JWT](https://jwt.io/). The displayed outputs are examples and vary depending on\nthe information associated with the given user in your project's auth database.\n\nAccording to the JWT specification, you can expect the following payload fields to be always \navailable: `iss`, `aud`, `auth_time`, `sub`, `iat`, `exp`. Other fields depend on the\nauthentication method of the given account and the information stored in your project's\nAuth database.\n\n```php\n$token = $verifier-\u003everifyIdToken('eyJhb...'); // An ID token given to your backend by a Client application\n\necho json_encode($token-\u003eheaders(), JSON_PRETTY_PRINT);\n// {\n//     \"alg\": \"RS256\",\n//     \"kid\": \"e5a91d9f39fa4de254a1e89df00f05b7e248b985\",\n//     \"typ\": \"JWT\"\n// }                                                   \n\necho json_encode($token-\u003epayload(), JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);\n// {\n//     \"name\": \"Jane Doe\",\n//     \"picture\": \"https://domain.tld/picture.jpg\",\n//     \"iss\": \"https://securetoken.google.com/your-project-id\",\n//     \"aud\": \"your-project-id\",\n//     \"auth_time\": 1580063945,\n//     \"user_id\": \"W0IturDwy4TYTmX6ilkd2ZbAXRp2\",\n//     \"sub\": \"W0IturDwy4TYTmX6ilkd2ZbAXRp2\",\n//     \"iat\": 1580063945,\n//     \"exp\": 1580067545,\n//     \"email\": \"jane@doe.tld\",\n//     \"email_verified\": true,\n//     \"phone_number\": \"+1234567890\",\n//     \"firebase\": {\n//         \"identities\": {\n//             \"phone\": [\n//                 \"+1234567890\"\n//             ],\n//             \"email\": [\n//                 \"jane@doe.tld\"\n//             ]\n//         },\n//         \"sign_in_provider\": \"custom\"\n//     }\n// }\n\necho $token-\u003etoString();\n// eyJhb...\n\n$tokenString = (string) $token; // string\n// eyJhb...\n```\n\n### Tenant Awareness\n\nYou can create custom tokens that are scoped to a given tenant:\n\n```php\n\u003c?php\n\nuse Kreait\\Firebase\\JWT\\CustomTokenGenerator;\n\n$generator = CustomTokenGenerator::withClientEmailAndPrivateKey('...', '...');\n\n$tenantAwareGenerator = $generator-\u003ewithTenantId('my-tenant-id');\n```\n\nSimilarly, you can verify that ID tokens were issued in the scope of a given tenant:\n\n```php\n\u003c?php\n\nuse Kreait\\Firebase\\JWT\\IdTokenVerifier;\n\n$verifier = IdTokenVerifier::createWithProjectId('my-project-id');\n\n$tenantAwareVerifier = $verifier-\u003ewithExpectedTenantId('my-tenant-id');\n```\n\nSession cookies currently don't support tenants.\n\n## Advanced usage\n\n### Cache results from the Google Secure Token Store\n\nIn order to verify ID tokens, the verifier makes a call to fetch Firebase's currently available public\nkeys. The keys are cached in memory by default.\n\nIf you want to cache the public keys more effectively, you can initialize the verifier with an \nimplementation of [psr/simple-cache](https://packagist.org/providers/psr/simple-cache-implementation)\nor [psr/cache](https://packagist.org/providers/psr/cache-implementation) to reduce the amount\nof HTTP requests to Google's servers. \n\nHere's an example using the [Symfony Cache Component](https://symfony.com/doc/current/components/cache.html):\n\n```php\nuse Kreait\\Firebase\\JWT\\IdTokenVerifier;\nuse Symfony\\Component\\Cache\\Adapter\\FilesystemAdapter;\n\n$cache = new FilesystemAdapter();\n\n$verifier = IdTokenVerifier::createWithProjectIdAndCache($projectId, $cache);\n```\n\n## Supported Versions\n\n**Only the latest version is actively supported.**\n\nEarlier versions will receive security fixes as long as their **lowest** PHP requirement receives security fixes. For\nexample, when a version supports PHP 7.4 and PHP 8.0, security support will end when security support for PHP 7.4 ends.\n\n| Version | Initial Release | Supported PHP Versions   | Status           |\n|---------|-----------------|--------------------------|------------------|\n| `5.x`   | 25 Nov 2023     | `~8.1.0, ~8.2.0, ~8.3.0` | Active           |\n| `4.x`   | 26 Nov 2022     | `~8.1.0, ~8.2.0, ~8.3.0` | Security Support |\n| `3.x`   | 25 Apr 2022     | `^7.4, ^8.0`             | End of life      |\n| `2.x`   | 03 Jan 2022     | `^7.4, ^8.0`             | End of life      |\n| `1.x`   | 06 Feb 2017     | `\u003e=5.5`                  | End of life      |\n\n## License\n\nThe MIT License (MIT). Please see [License File](LICENSE) for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkreait%2Ffirebase-tokens-php","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkreait%2Ffirebase-tokens-php","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkreait%2Ffirebase-tokens-php/lists"}