{"id":36986607,"url":"https://github.com/sprocketbox/laravel-jwt","last_synced_at":"2026-01-13T23:04:42.357Z","repository":{"id":57057179,"uuid":"222569884","full_name":"sprocketbox/laravel-jwt","owner":"sprocketbox","description":"A seamless JWT implementation for Laravel","archived":false,"fork":false,"pushed_at":"2020-09-09T16:21:39.000Z","size":49,"stargazers_count":68,"open_issues_count":5,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-08-04T01:42:15.067Z","etag":null,"topics":["jwt","jwt-auth-guard","laravel","laravel-authentication","laravel-package"],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sprocketbox.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-11-19T00:09:13.000Z","updated_at":"2025-03-24T01:09:38.000Z","dependencies_parsed_at":"2022-08-24T14:53:02.068Z","dependency_job_id":null,"html_url":"https://github.com/sprocketbox/laravel-jwt","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/sprocketbox/laravel-jwt","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sprocketbox%2Flaravel-jwt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sprocketbox%2Flaravel-jwt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sprocketbox%2Flaravel-jwt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sprocketbox%2Flaravel-jwt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sprocketbox","download_url":"https://codeload.github.com/sprocketbox/laravel-jwt/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sprocketbox%2Flaravel-jwt/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28405130,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-13T21:51:37.118Z","status":"ssl_error","status_checked_at":"2026-01-13T21:45:14.585Z","response_time":56,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["jwt","jwt-auth-guard","laravel","laravel-authentication","laravel-package"],"created_at":"2026-01-13T23:04:41.718Z","updated_at":"2026-01-13T23:04:42.350Z","avatar_url":"https://github.com/sprocketbox.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Laravel JWT\n[![Latest Stable Version](https://poser.pugx.org/sprocketbox/laravel-jwt/v/stable.png)](https://packagist.org/packages/sprocketbox/laravel-jwt) \n[![Latest Unstable Version](https://poser.pugx.org/sprocketbox/laravel-jwt/v/unstable.png)](https://packagist.org/packages/sprocketbox/laravel-jwt) \n[![License](https://poser.pugx.org/sprocketbox/laravel-jwt/license.png)](https://packagist.org/packages/sprocketbox/laravel-jwt)\n[![Scrutinizer Code Quality](https://scrutinizer-ci.com/g/sprocketbox/laravel-jwt/badges/quality-score.png?b=master)](https://scrutinizer-ci.com/g/sprocketbox/laravel-jwt/?branch=master)\n\n- **Laravel**: 6\n- **PHP**: 7.2+\n- **License**: MIT\n- **Author**: Ollie Read \n- **Author Homepage**: https://sprocketbox.io\n\nLaravel JWT provides a seamless JWT (JSON Web Tokens) implementation that integrates directly with Laravels \nauthentication library allowing for stateless API authentication.\n\n#### Table of Contents\n\n- [Installing](#installing)\n- [Configuring](#configuring)\n    - [Quick configuration](#quick-configuration)\n    - [Driver](#driver)\n    - [Key](#key)\n    - [Signer](#signer)\n    - [TTL](#ttl)\n    - [Customer generation](#custom-generation)\n    - [Customer validation](#custom-validation)\n- [Usage](#usage)\n    - [Providing the token](#providing-the-token)\n    - [Getting the token](#getting-the-token)\n    - [Example](#example)\n    - [Avoiding XSS](#avoiding-xss)\n    - [Events](#events)\n- [The token](#the-token)\n- [The future](#the-future)\n\n## Installing\nTo install this package simply run the following command.\n\n```\ncomposer require sprocketbox/laravel-jwt\n```\n\nThis package uses auto-discovery to register the service provider but if you'd rather do it manually, \nthe service provider is:\n\n```\nSprocketbox\\JWT\\JWTServiceProvider\n```\n\n## Configuring\nThere are no extra configuration files required, but there are a few extra options when configuring a guard in\n`config/auth.php`.\n\nHere's an example configuration for a JWT guard.\n\n```php\n'api' =\u003e [\n    'driver'   =\u003e 'jwt',\n    'provider' =\u003e 'users',\n    'key'      =\u003e env('JWT_KEY_API'),\n    'signer'   =\u003e Lcobucci\\JWT\\Signer\\Hmac\\Sha256::class,\n    'ttl'      =\u003e 'P1M',\n],\n```\n\n### Quick configuration\nIf you don't care to dive into all the extra bits you can create a very minimal JWT guard config\nby:\n\n - Changing the driver to `jwt` \n - Add `'key' =\u003e env('JWT_KEY_GUARD'),` where `GUARD` is the name of your auth guard\n - Run `php artisan jwt:generate guard` where `guard` is the name of your auth guard\n - Make sure to duplicate the env variable, but not the value, into your `.env.example` file\n\n### Driver\nIf you wish to use the JWT driver, just set the `driver` option to `jwt`.\n\n### Key\nIf you wish for your tokens to be signed you must, at the very least, provide a key using the `key` option.\nAs the default signature uses a SHA256 HMAC, I recommend a 64 character key.\n\nIt's best you place this key in your env file as `JWT_KEY` or something similar.\n\n### Signer\nBy default this package will create a signature using a SHA256 HMAC, but if you wish to change that you can\nset the `signer` option to be the class name of a valid signer.\n\nThe default is `Lcobucci\\JWT\\Signer\\Hmac\\Sha256` but there are other options in the \n[`Lcobucci\\JWT\\Signer` namespace](https://github.com/lcobucci/jwt/tree/master/src/Signer). If you wish to keep the \ndefault you can omit this option.\n\n### TTL\nBy default this package will set the TTL (total time to live) to 1 month, or more precisely `P1M`. If you wish to change\nthis you can set the `ttl` config value to be a valid [interval spec](https://www.php.net/manual/en/dateinterval.construct.php#refsect1-dateinterval.construct-parameters).\n\n### Custom generation\nIf you wish to generate the token yourself you can provide a custom generator like so:\n\n```php\nAuth::guard('api')-\u003esetTokenGenerator(function (\\Illuminate\\Contracts\\Auth\\Authenticatable $user, \\Sprocketbox\\JWT\\JWTGuard $guard) {\n    return $instanceOfBuilder;\n});\n```\n\nThe generator must return an instance of `Lcobucci\\JWT\\Builder`.\n\n### Custom validation\nIf you wish to provide custom validation for your token you may provide it like so:\n\n```php\nAuth::guard('api')-\u003esetTokenValidator(function (\\Lcobucci\\JWT\\Token $token, \\Sprocketbox\\JWT\\JWTGuard $guard) {\n    return $validationState;\n});\n```\n\nIf the validation fails you must return `false`. Any other return type, including `null` will be treated as a pass.\n\n### Custom token signature generation\nIn some situations you may find that the static signing method and key in the config isn't sufficient. If that is the\ncase, you can provide an override like so:\n\n```php\nAuth::guard('api')-\u003esetTokenSigner(function (\\Sprocketbox\\JWT\\JWTGuard $guard): array {\n    return [\n        new config('auth.guards.api.signer'), \n        new \\Lcobucci\\JWT\\Signer\\Key(config('auth.guards.api.key'))\n    ];\n});\n```\n\nThis must return an array with two indexes, the first being the signer and the second being the key.\n\n## Generating keys\nYou can generate a key per guard by running the `jwt:generate` command with the name of the guard. The \ncommands signature is:\n\n```\njwt:generate {guard}\n    {--length : The length of the key, defaults to 32}\n    {--show : Display the key instead of modifying files}\n    {--force : Force the operation to run when in production}\n```\n\n## Usage\nThis package functions in an almost identical way to Laravels session authentication, with a few exceptions.\n\n### Providing the token\nThe token is loaded as a bearer token, so you must provide it as a bearer token in the HTTP authorization header.\n\n```php\nAuthorization: Bearer TOKEN_HERE\n```\n\nIf you passed `true` as the second argument for `attempt()` the token will be automatically provided\nby the cookie, removing the need to manually pass the token.\n\n### Getting the token\nThe `Auth::attempt($credentials)` method is missing the second parameter (remember me) and instead of returning a \nboolean, returns an instance of `Lcobucci\\JWT\\Token`. Casting this object to a string will give you the\nactual JWT token.\n\nIf you wish to get the token currently being used, as in, the currently authenticated token, you can call the `token()`\nmethod on the guard, the same way you would call `user()`\n\n### Example\nTake the following code as an example:\n\n```php\n$input = $request-\u003eonly('email', 'password');\n$token = Auth::guard('api')-\u003eattempt($input);\n\nif ($token !== null) {\n    return response()-\u003ejson(['token' =\u003e (string) $token]);\n}\n\nreturn response()-\u003ejson(null, 401);\n```\n\n### Avoiding XSS\nIf you pass `true` as the second argument for `attempt()` the guard will create a HTTP only\n(Not accessible via javascript) cookie. This will prevent you from having to store the token in\nthe browsers localStorage.\n\nTo make sure that the cookie is added to the response you need to add the following middleware to \nyour routes.\n\n```\nIlluminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse::class\n```\n\nIt makes sense to add this to the `api` group. Though it's not technically required, I recommend that \nyou also add the following middleware to encrypt the cookies.\n\n```\nApp\\Http\\Middleware\\EncryptCookies::class\n```\n\nIt's also advised to simply return a `204` response when using this method so that the token data isn't\noutput anywhere.\n\n### Events\nThe login and authenticated events are called just like with the session guard.\n\n## The token\nBy default the token generation is somewhat opinionated, but that is because this is the initial version of this package.\n\nThe following covers how the claims are populated.\n\n- Issued by/Issuer (`iss`) is set to `config('app.url')`\n- Permitted for/Audience (`aud`) is also set to `config('app.url')`\n- Identified by/ID (`jti`) is a UUID4 generated with the token\n- Issued at (`iat`) is set to the current timestamp\n- Expires at (`exp`) is set to the current timestamp + the value of `ttl` (defaults to `P1M`)\n- Related to/Subject (`sub`) is set to the value of `Authenticatable::getAuthIdentifier()`\n\nThe token is generated using the [lcobucci/jwt](https://github.com/lcobucci/jwt) package.\n\n## The future\nThere are a couple of things that I wish to add into later versions of this package.\nI've made an attempt to list them all here, as a sort of roadmap.\n\n- [x] HTTP Only cookie support (XSS)\n- [x] Custom token generation\n- [x] Custom token validation\n- [x] Custom token signature\n- [ ] Database driven log of `jti`, `aud` and `exp` to blacklist and revoke tokens\n- [ ] Provide auth scaffolding for generating JWTs\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsprocketbox%2Flaravel-jwt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsprocketbox%2Flaravel-jwt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsprocketbox%2Flaravel-jwt/lists"}