Weave Code
Laravel Jwt Laravel Package
a2workspace/laravel-jwt
JWT authentication for Laravel: issue and validate JSON Web Tokens for stateless API auth. Plugs into Laravel's auth guards and middleware to protect routes, with configurable signing keys, token lifetimes, and claims for flexible, token-based access control.
a2workspace/laravel-jwt provides a lightweight JWT authentication layer for Laravel applications. It wraps JSON Web Token issuance and verification in a familiar Laravel service provider, config file, and middleware so you can authenticate API requests without pulling in a full OAuth stack.
Tokens are signed and validated through a clean facade, with configurable secrets, algorithms, and lifetimes defined in a published config file.
- Generate, decode, and validate signed JWT tokens via a simple API
- Drop-in middleware for protecting routes and resolving the authenticated user
- Publishable config for secrets, TTL, and signing algorithms
- Framework-native integration with Laravel's service container and facades
Frequently asked questions about Laravel Jwt
- How do I install a2workspace/laravel-jwt in a Laravel application?
- Install it with Composer using composer require a2workspace/laravel-jwt. The package is built to be nearly zero-config, so auto-discovery registers its service provider and you can start protecting routes right away. If you want to change token lifetimes, the signing secret, or claim mappings, check the README for any publishable configuration and the required environment variables. After installing, run your existing migrations and clear the config cache so Laravel picks up the new settings.
- How does this package protect API routes with JWT middleware?
- You attach the package's JWT guard middleware to the routes or route groups you want to protect, typically inside routes/api.php. Requests must then carry a valid token, and the middleware verifies the signature and expiry before the request reaches your controller. Invalid or missing tokens are rejected before your application logic runs, and the authenticated user is resolved through Laravel's native guard system so auth()->user() keeps working as usual.
- How do I issue a JWT for a user after login?
- Once credentials are validated in your login controller, you call the package's token-issuing API with the authenticated user to generate a token you return as JSON. The token embeds the configurable claims you have defined, such as the subject identifier and expiry, and is signed with your application secret. Because it is framework-native, the user instance comes straight from Laravel's auth system rather than a separate model or adapter.
- Can I refresh an expired token with this package?
- Yes, refresh is one of the three core operations alongside issuing and verifying tokens. Your client sends a refreshable token to a refresh endpoint you define, and the package returns a newly signed token with a fresh expiry. You control how long tokens stay valid through configuration, so you can tune the balance between security and how often clients must re-authenticate.
- Can I customize the claims included in the JSON Web Token?
- Yes, the package exposes configurable claims, so you can add your own identifiers or metadata to the token payload alongside the defaults such as subject and expiry. Claims are defined in configuration rather than hard-coded, which keeps your token structure consistent across endpoints. Only include non-sensitive data, since JWT payloads are encoded rather than encrypted and are readable by anyone holding the token.
- Which Laravel versions does a2workspace/laravel-jwt support?
- Support depends on the Laravel and PHP constraints declared in the package's composer.json, so check that file or the README before upgrading your application. Because the package is lightweight and framework-native, it generally tracks recent Laravel releases closely. If you are on an older Laravel version, verify the compatibility table first or install a tagged release that matches your framework version.
- How do I test JWT-protected routes in my Laravel test suite?
- The simplest approach is to issue a real token for a factory-created user in your test setup and pass it in the Authorization header with your HTTP test calls. That exercises the same middleware path as production instead of bypassing authentication, which catches signature and expiry mistakes early. You can also assert on the refresh behaviour by freezing time or setting a very short token lifetime in a test-specific configuration.
- Is a2workspace/laravel-jwt suitable for production use?
- Yes, JWT bearer authentication is a well-understood pattern for stateless APIs, and this package keeps the implementation small and framework-native. In production, store your signing secret in the environment file, keep token lifetimes short, and serve your API over HTTPS only. Remember that stateless tokens cannot be revoked individually without extra work, so plan for short expiries or a token denylist if you need immediate logout.
- How is this different from tymon/jwt-auth or Laravel Sanctum?
- Sanctum is session and API-token based and remains the default choice for first-party SPAs, while this package focuses purely on stateless JSON Web Tokens with configurable claims. Compared with heavier JWT libraries, a2workspace/laravel-jwt emphasises almost zero configuration and a small surface area so you can drop it into an existing app quickly. Choose it when you specifically want self-contained, verifiable tokens that other services can validate without calling your Laravel app.
- Is the package maintained, and how do I report issues or contribute?
- The source lives on GitHub at a2workspace/laravel-jwt, where you can open issues for bugs and feature requests. Check the repository's commit history and releases to gauge activity before committing to it in a long-lived project. Pull requests are the usual route for fixes, and pinning a known-good version in composer.json protects you from unexpected changes.
Weaver
How can I help you explore Laravel packages today?