- How do I install medzuch/jwt-php with Composer?
- Install it with composer require medzuch/jwt-php and let Composer's autoloader handle the PSR-friendly class structure. There are no framework bootstrap files, service providers, or published config to run, so the package is usable as soon as the dependency is installed. In a Laravel project the classes are autoloaded like any other Composer package.
- Does medzuch/jwt-php work with Laravel, and which Laravel versions are supported?
- The library is framework-agnostic and has no Laravel or external dependencies, so it runs inside any Laravel version that supports the PHP version you are on. Because there is no service provider or facade, you simply instantiate the encoder/decoder in a controller, middleware, or service class. Check the package's composer.json for the exact PHP version constraint before upgrading your application.
- Which JWT signing algorithms does medzuch/jwt-php support?
- It supports HMAC signing with HS256, HS384, and HS512, which covers shared-secret scenarios where the issuer and verifier both hold the same key. There is no mention of asymmetric algorithms such as RS256 or ES256, so it is not the right fit if you need public/private key signing. Keep the secret out of source control and load it from your environment.
- How does claim validation for exp, nbf, and iat work?
- The library performs claim validation including exp, nbf, and iat checks when decoding a token, so expired or not-yet-valid tokens are rejected during verification. Validation is tied to the current system time, so keep server clocks synchronized across all services that issue or verify tokens. Review the README for the exact failure behavior in your installed version before relying on it in authentication flows.
- How do I add custom claims and create a signed token?
- You build a token through the library's simple, chainable interface: set your claims, then sign the payload with your HMAC secret. Standard claims such as sub, iss, and aud can be included alongside your own custom claims. Because the API is minimal, token construction usually fits in a few lines inside a small token service class.
- What happens when a token is invalid, malformed, or expired?
- Decoding a token that fails signature verification or claim validation is reported as a failure rather than returning trusted claims. Depending on the method you call, that surfaces as a thrown exception or a falsy result, so wrap verification in a try/catch or an explicit check. Never use unverified decoded payloads for authorization decisions.
- Is medzuch/jwt-php safe and actively maintained for production use?
- It is a small, dependency-free library, which keeps the attack surface and upgrade risk low. Maintenance activity is not documented in the provided overview, so check the repository's commit history and open issues before adopting it. Pin the version in composer.json and review changes when updating.
- How does medzuch/jwt-php compare to firebase/php-jwt or lcobucci/jwt?
- This package is deliberately smaller: HMAC algorithms only, no asymmetric key support, and no encryption. firebase/php-jwt and lcobucci/jwt cover a wider algorithm set, key objects, and richer validation options if you need RS256 or JWKS handling. Choose medzuch/jwt-php when you want a minimal shared-secret JWT implementation without extra dependencies.
- Can I use medzuch/jwt-php for stateless Laravel API authentication?
- Yes. Issue a signed token on login, return it to the client, and verify it in a middleware or guard-like class on each protected request. The library handles encoding and verification only, so token storage, refresh tokens, revocation, and user lookup remain your responsibility. Pair it with HTTPS and short expiry times for safer API access tokens.
- How should I test JWT creation and verification in my test suite?
- Use a fixed test secret and assert that a token you encode round-trips back to the expected claims. Avoid asserting on hardcoded exp or iat values, since they depend on the current time; instead decode the token and compare claims loosely, or generate tokens with a very short lifetime to test expiry paths. Also add a test that a token signed with the wrong secret is rejected.