Weave Code
Php Jose Verifier Laravel Package
facile-it/php-jose-verifier
A lightweight PHP library for validating JWT tokens from OpenID and OAuth2 providers. It builds verifiers and decrypters automatically from issuer and client metadata, fetching public keys from a jwks_uri endpoint, with optional GMP support for better performance.
Facile JOSE Verifier is a PHP library for validating JWT tokens, built for OAuth2 and OpenID Connect flows. It lets you create verifiers and decrypters from Issuer Metadata (issuer, jwks_uri) and Client Metadata (client_id, optional client_secret), automatically fetching remote public keys from the issuer's JWK Set.
- Configure verifiers and decrypters via simple builders
- Supports OpenID Dynamic Registration client metadata
- Handles signed tokens (asymmetric and symmetric keys) and encrypted tokens
- Validates against remote JWKS endpoints
- Optional
ext-gmpfor improved performance
Frequently asked questions about Php Jose Verifier
- How do I install facile-it/php-jose-verifier in a Laravel application?
- Install it with Composer using composer require facile-it/php-jose-verifier. The package is framework-agnostic and ships no Laravel service provider, facade, or config file, so you bind it yourself in a service provider. For better RSA verification performance, install ext-gmp in the PHP runtime.
- Does facile-it/php-jose-verifier have a Laravel service provider or facade?
- No. The package is plain PHP and does not include Laravel integration. You typically create a thin wrapper: a config/oidc.php file for issuer and client metadata, a service provider binding verifiers as singletons, and middleware or a guard to validate incoming tokens. You also own the PSR-18 HTTP client and PSR-16 cache adapters it needs.
- How do I configure token verification for Keycloak, Auth0, Okta, or Entra ID in Laravel?
- Use the package builders with issuer metadata containing issuer and jwks_uri, plus client metadata such as client_id and optional client_secret. The builder auto-configures the AccessToken, IdToken, and UserInfo verifiers from that metadata. In Laravel, store per-issuer values in config/oidc.php and resolve the appropriate verifier from the container.
- How does JWKS caching work with Laravel's cache store in this package?
- The package uses PSR-16 SimpleCache for JWKS caching, but Laravel's Cache facade does not implement PSR-16. You need an adapter over a Laravel cache store, such as Symfony's cache bridge or a small custom adapter. Without it, every request may refetch the remote JWKS, adding latency and availability risk.
- Which PHP and Laravel versions does facile-it/php-jose-verifier support?
- The package requires PHP 8.1 or later and supports PHP 8.5 per the changelog. It is framework-agnostic, so it can be used with any Laravel version that runs on a supported PHP release. Check the composer.json constraints for the exact current 0.5.x line before upgrading.
- Can I use facile-it/php-jose-verifier to verify OAuth2 access tokens in a Laravel API?
- Yes. It is designed for resource-server and relying-party scenarios where your Laravel API validates JWTs issued by an external OIDC provider. Use the AccessToken verifier for access tokens and the IdToken verifier for OpenID Connect ID tokens. It does not issue tokens, so it is not a replacement for Laravel Passport or tymon/jwt-auth.
- How do I test JWT verification in Laravel when using this package?
- Generate signed test tokens with the same algorithms and keys your issuer uses, then point the verifier at a local or mocked JWKS endpoint. Because the package depends on PSR-18 and PSR-16, you can inject fake HTTP clients and cache implementations in tests. Keep a small set of fixtures for valid, expired, wrong-issuer, and wrong-audience tokens.
- Does facile-it/php-jose-verifier support token revocation or introspection?
- No. The package validates JWT signatures and claims; it does not implement OAuth2 token revocation or introspection endpoints, and it does not handle opaque tokens. If you need immediate invalidation, use short token lifetimes or make a separate introspection call against the issuer.
- Is facile-it/php-jose-verifier production-ready and actively maintained?
- It is a focused, usable library, but adoption is low, with few dependents and single-vendor stewardship by Facile.it, so budget for a vendor-or-fork scenario. The current line is pre-1.0 at 0.5.x, and past minor upgrades have included breaking changes, so pin exact versions. Most cryptographic risk sits in its web-token/jwt-library dependency, so monitor that subtree with Composer audit.
- What are alternatives to facile-it/php-jose-verifier for Laravel JWT verification?
- Alternatives include firebase/php-jwt with custom JWKS handling, web-token/jwt-library directly, or provider SDKs for Auth0, Okta, or Entra ID. Laravel Passport and tymon/jwt-auth solve different problems because they issue and verify first-party tokens rather than trusting an external OIDC issuer. This package's value is the prebuilt builder and verifier layer over remote JWKS.
Weaver
How can I help you explore Laravel packages today?