Weave Code
Jwt Auth Laravel Package
php-open-source-saver/jwt-auth
Maintained fork of tymondesigns/jwt-auth providing JWT authentication for Laravel. Same API with the PHPOpenSourceSaver\JWTAuth namespace, making migration easy, plus ongoing support and full documentation.
php-open-source-saver/jwt-auth is a community-maintained fork of tymondesigns/jwt-auth, kept up to date and actively supported for modern Laravel applications. It provides the same familiar API with a new PHPOpenSourceSaver\JWTAuth namespace, so migrating is as simple as swapping namespaces and running composer require. Full documentation is available at laravel-jwt-auth.readthedocs.io.
Key features:
- Drop-in migration from
tymondesigns/jwt-authwith an identical API - JSON Web Token authentication for Laravel guards
- Active maintenance and ongoing bug fixes
- Security policy for responsible disclosure
- MIT licensed and open source
Frequently asked questions about Jwt Auth
- How do I install and configure php-open-source-saver/jwt-auth in Laravel?
- Install it with composer require php-open-source-saver/jwt-auth, then publish the config file and set a JWT_SECRET in your .env. Register the jwt guard in config/auth.php with driver set to jwt and point it at your user provider. The package auto-registers its service provider and auth driver through Laravel package discovery, so no manual provider wiring is needed in a standard app.
- How do I migrate from tymondesigns/jwt-auth to this fork?
- The documented migration is three steps: run composer remove tymon/jwt-auth, replace every Tymon\JWTAuth occurrence with PHPOpenSourceSaver\JWTAuth, then run composer require php-open-source-saver/jwt-auth. Because the API is the same, most codebases complete this in a single day. The only documented breaking change is the JWTGuard constructor now requiring an $eventDispatcher argument, which only affects apps that opted out of package auto-discovery or build the guard manually.
- Which Laravel and PHP versions does php-open-source-saver/jwt-auth support?
- The package targets Laravel 10 through 13 on PHP 8.2 and newer, with PHP 8.1 support dropped in v2.8.0. It supports Carbon 2 and Carbon 3 and depends on lcobucci/jwt ^5.0 only since v2.4.0. A Laravel 13 CI entry landed in v2.9.0, which shows the maintainers tracking framework releases early.
- Is php-open-source-saver/jwt-auth still actively maintained?
- Yes, it is an actively maintained fork created because tymondesigns/jwt-auth had gone unmaintained. It has roughly 844 GitHub stars and a small volunteer contributor set, with no commercial sponsor, LTS commitment, or published EOL policy. That is its main governance risk: if the fork stalls, you inherit the same failure mode it was created to escape, so pin versions and track releases.
- How do I set up the jwt guard in config/auth.php?
- Add a guard under the guards array with driver set to jwt and provider set to your users provider. The package registers the jwt auth driver through its service provider, so it sits alongside the session and sanctum drivers in the standard guard configuration. After that you can call auth('api')->attempt() and protect routes with the auth:api middleware as usual.
- Is JWT authentication with this package truly stateless?
- Only until you revoke something. Logout and token blacklisting store state in Laravel's cache, so revocation depends on cache availability, key namespacing, and eviction behavior. A cache flush or Redis failover can silently turn revoked tokens back into valid tokens, which is a security-relevant failure mode that normal tests will not catch.
- Should I use this package or Laravel Sanctum for API authentication?
- Sanctum is first-party and Laravel-maintained, so it carries materially less governance risk if its token model meets your requirements. Choose this JWT package when you specifically need self-contained bearer tokens, refresh token pairs, or compatibility with an existing JWT-based API. Teams adopting the fork should document why they prefer a community fork over the first-party option.
- Does php-open-source-saver/jwt-auth support refresh tokens, per-guard TTLs and logout blacklisting?
- Yes. It supports access and refresh token pairs, blacklist-on-logout, and per-guard TTL configuration added in v2.2.0. It also dispatches auth events (extended in v2.9.1), delegates getUserId() and Auth::id(), and supports cookie-based token delivery with a configurable cookie name since v2.7.2.
- Is php-open-source-saver/jwt-auth compatible with Laravel Octane?
- Yes, Octane compatibility has been available since v2.0.0-RC1. Because the package resolves configuration and cache through Laravel's container, it behaves correctly under long-running workers. If you build custom guard instances manually, make sure you pass the event dispatcher required by the JWTGuard constructor.
- What breaking changes should I check before upgrading php-open-source-saver/jwt-auth?
- Watch for the JWTGuard constructor now requiring $eventDispatcher, and for PHP 8.1 being dropped in v2.8.0. Release cadence is fast and semver-loose in practice: the iat refresh behavior changed in 2.5.0 and was reverted behind a config toggle in 2.8.0 and 2.8.3. Pin exact versions and read the changelog before every upgrade.
Weaver
How can I help you explore Laravel packages today?