kinetis / auth-jwt

v1.2.0 2026-09-05 08:02 UTC

Requires

• php: ^8.4
• ext-openssl: *
• firebase/php-jwt: ^7.1.0
• kinetis/framework: ^1.3.1
• nyholm/psr7: ^1.8.2
• psr/http-message: ^2.0
• psr/http-server-middleware: ^1.0.2
• psr/simple-cache: ^3.0.0

Requires (Dev)

• infection/infection: ^0.35.0
• phpstan/phpstan: ^2.2.8
• phpunit/phpunit: ^12.5.33
• vimeo/psalm: ^6.16.1

MIT

• Alon Noy

Published on Packagist.org on 2026-09-05 08:08 UTC

README

kinetis/auth-jwt
Stateless JWT authentication middleware for Kinetis

Part of Kinetis, a non-blocking PHP framework for API-first applications, developed in the kinetis-dev/kinetis monorepo.

A PSR-15 route middleware that verifies an Authorization: Bearer <token> header's signature and registers the decoded claims on the current request as both CurrentUserInterface and the concrete JwtUser (the identical object either way — inject JwtUser directly when you need a claim beyond the subject, roles or jti for instance), plus an issuer for signing tokens. Verification via firebase/php-jwt (HS256/RS256, optional per-token revocation) — no database or cache lookup; the signed claims are the entire authentication decision.

use Kinetis\AuthJwt\JwtAuthMiddleware;
use Kinetis\Config\Config;
use Kinetis\Container\RequestScope;
use Kinetis\Http\Attributes\Get;
use Kinetis\Http\Attributes\Middleware;
use Kinetis\Http\CurrentUserInterface;

final class AppJwtAuthMiddleware extends JwtAuthMiddleware
{
    public function __construct(RequestScope $scope, Config $config)
    {
        parent::__construct($config->required('JWT_SECRET'), $scope);
    }
}

#[Middleware(AppJwtAuthMiddleware::class)]
final readonly class OrderController
{
    public function __construct(
        private CurrentUserInterface $user,
    ) {}

    #[Get('/orders')]
    public function index(): array
    {
        return ['userId' => $this->user->id()];
    }
}

Rotating signing keys: JwkSet publishes PublishedRsaKey values as an RFC 7517 JWK Set for a .well-known/jwks.json route, and ParsedJwkSet::fromJson() parses raw JWKS JSON back into the key set JwtAuthMiddleware verifies against — kids carried and matched as the exact strings the document published, every key validated before the set exists.

Need opaque Bearer-token validation against your own storage instead? See kinetis/auth.

Installation

composer require kinetis/auth-jwt

Requires PHP 8.4+ and kinetis/framework. Full documentation: kinetis.dev/docs/auth-jwt.html.

License

MIT — see LICENSE.