- How do I install kelvinmo/simplejwt in a Laravel application?
- Install it with Composer using composer require kelvinmo/simplejwt. The package is a plain PHP library, so Laravel integration is manual: bind key sets or services in the container and add middleware where needed. Confirm your environment has the required PHP extensions before deploying.
- Does SimpleJWT support Laravel 9, 10, and 11?
- SimpleJWT requires PHP 8.0 or later and has no Laravel-specific framework constraints. It is validated against Laravel 9+ in the assessment, but you should re-test on your current Laravel LTS. Because there is no service provider, compatibility mostly depends on PHP and extension availability.
- Is there a Laravel service provider for SimpleJWT?
- No, SimpleJWT does not ship with a Laravel service provider. You integrate it by binding KeySet instances or wrapper services in Laravel's container. Add your own middleware for token verification and configuration for key management.
- How do I use SimpleJWT to create and verify JWTs in Laravel?
- Load signing or verification keys into a SimpleJWT KeySet, then use the library's JWT encode and decode APIs with the appropriate algorithm. In Laravel, wrap this logic in a service class and inject it into controllers or middleware. Keep algorithm and header validation strict in production.
- Can SimpleJWT replace or work with Laravel Sanctum and Passport?
- SimpleJWT can replace or augment Sanctum and Passport where stateless JWT or JWE flows are required. It is not a drop-in replacement for Laravel's built-in auth stack, so decide explicitly whether it replaces, extends, or coexists with existing auth mechanisms. Many teams use it alongside Laravel auth for service-to-service or encrypted-token use cases.
- Does SimpleJWT support JWE encryption in Laravel?
- Yes, SimpleJWT implements JSON Web Encryption under RFC 7516 and supports AES-CBC-HMAC-SHA2 and AES-GCM content encryption. This is useful for Laravel APIs that need encrypted payloads for sensitive or regulated data. Treat JWE compression as optional and enforce request-size limits at the API boundary.
- How should I manage and rotate JWT keys with SimpleJWT in Laravel?
- Use SimpleJWT's KeySet abstraction to load keys from JWK sets, PEM files, or HMAC secrets, and bind the set as a singleton or scoped service. Store asymmetric keys in Laravel config, environment variables, a dedicated keys table, or an external KMS or Vault. Define rotation and revocation procedures and never hardcode production secrets.
- What PHP extensions does SimpleJWT require and how do I verify them?
- SimpleJWT requires PHP 8.0+, the gmp, hash, and openssl extensions, plus sodium for EdDSA and X25519 support. Check them with php -m or phpinfo() in your Laravel runtime and CI environment. If sodium is unavailable, plan to use RSA or ECDSA instead of EdDSA.
- What security issue does SimpleJWT v1.1.3 fix for JWE compression?
- Version 1.1.3 adds validation for the length of decompressed data when using JWE compression with zip:DEF. This reduces exposure to decompression-based denial-of-service patterns in Laravel endpoints that accept compressed JWE payloads. Upgrade to at least v1.1.3 and still enforce maximum HTTP payload and decompressed-size limits.
- How does SimpleJWT compare to firebase/php-jwt for Laravel projects?
- firebase/php-jwt is a focused JWT signing and verification library, while SimpleJWT also covers JWS, JWE, JWK, COSE keys, and key-management algorithms. Choose SimpleJWT when you need encrypted payloads or broader standards support, and benchmark JWT and JWE paths because encryption adds overhead. For simple signed-token use cases, firebase/php-jwt may be lighter.