authaction/authaction-php-sdk

AuthAction JWT verification SDK for PHP — Laravel, PSR-15, plain PHP

v0.1.0 2026-06-03 23:20 UTC

Requires

• php: >=8.1
• firebase/php-jwt: ^6.0 || ^7.0

Requires (Dev)

• phpunit/phpunit: ^10.0
• psr/http-factory: ^1.0
• psr/http-message: ^1.0|^2.0
• psr/http-server-handler: ^1.0
• psr/http-server-middleware: ^1.0

Suggests

• illuminate/http: Required for Laravel middleware support
• psr/http-server-middleware: Required for PSR-15 middleware support

MIT

README

AuthAction JWT verification SDK for PHP 8.1+. Works with Laravel, PSR-15 frameworks (Slim, Mezzio), and plain PHP.

Installation

composer require authaction/authaction-php-sdk

Quick start

use AuthAction\AuthAction;

$aa = new AuthAction(
    domain:   $_ENV['AUTHACTION_DOMAIN'],
    audience: $_ENV['AUTHACTION_AUDIENCE'],
);

// Verify a raw token — throws TokenExpiredException / TokenInvalidException on failure
$payload = $aa->verifyToken($token);
echo $payload->sub;

// Verify from Authorization header — returns null on missing/invalid
$payload = $aa->verifyRequest($_SERVER['HTTP_AUTHORIZATION'] ?? null);

Laravel

// bootstrap/app.php
->withMiddleware(function (Middleware $middleware) {
    $middleware->alias(['auth.jwt' => \AuthAction\Middleware\LaravelMiddleware::class]);
})

// routes/api.php
Route::middleware('auth.jwt')->get('/me', function (Request $request) {
    $user = $request->get('authaction.user');
    return ['sub' => $user->sub];
});

Register AuthAction as a singleton in a ServiceProvider:

$this->app->singleton(AuthAction::class, fn () =>
    new AuthAction(config('authaction.domain'), config('authaction.audience'))
);

PSR-15 (Slim, Mezzio)

use AuthAction\Middleware\PsrMiddleware;
use Slim\Factory\AppFactory;

$app = AppFactory::create();
$app->add(new PsrMiddleware($verifier, $responseFactory));

$app->get('/protected', function (Request $request, Response $response) {
    $user = $request->getAttribute('authaction.user');
    $response->getBody()->write(json_encode(['sub' => $user->sub]));
    return $response;
});

Exceptions

use AuthAction\Exception\TokenExpiredException;
use AuthAction\Exception\TokenInvalidException;

try {
    $payload = $aa->verifyToken($token);
} catch (TokenExpiredException $e) {
    http_response_code(401);
    echo json_encode(['error' => 'Token has expired']);
} catch (TokenInvalidException $e) {
    http_response_code(401);
    echo json_encode(['error' => $e->getMessage()]);
}

Environment variables

AUTHACTION_DOMAIN=your-tenant.eu.authaction.com
AUTHACTION_AUDIENCE=https://api.your-app.com

License

MIT