kinetis/auth-jwt

Stateless JWT authentication middleware for Kinetis (HS256/RS256, optional per-token revocation), verifying signed tokens via firebase/php-jwt. See kinetis/auth instead for opaque Bearer-token validation against your own storage.

v1.0.3 2026-08-16 08:56 UTC

Requires

• php: ^8.4
• ext-openssl: *
• firebase/php-jwt: ^7.1
• kinetis/framework: ^1.6
• nyholm/psr7: ^1.8
• psr/http-message: ^2.0
• psr/http-server-middleware: ^1.0
• psr/simple-cache: ^3.0

Requires (Dev)

• infection/infection: ^0.34.2
• phpstan/phpstan: ^2.2
• phpunit/phpunit: ^11.0
• vimeo/psalm: ^6.16

MIT

• Alon Noy

Published on Packagist.org on 2026-08-16 08:56 UTC

README

kinetis/auth-jwt
Stateless JWT authentication middleware for Kinetis

A PSR-15 route middleware that verifies an Authorization: Bearer <token> header's signature and registers the decoded claims on the current request as CurrentUserInterface, plus an issuer for signing tokens. Verification via firebase/php-jwt (HS256/RS256, optional per-token revocation) — no database or cache lookup; the signed claims are the entire authentication decision.

use Kinetis\AuthJwt\JwtAuthMiddleware;
use Kinetis\Config\Config;
use Kinetis\Container\RequestScope;
use Kinetis\Http\Attributes\Get;
use Kinetis\Http\Attributes\Middleware;
use Kinetis\Http\CurrentUserInterface;

final class AppJwtAuthMiddleware extends JwtAuthMiddleware
{
    public function __construct(RequestScope $scope, Config $config)
    {
        parent::__construct($config->required('JWT_SECRET'), $scope);
    }
}

#[Middleware(AppJwtAuthMiddleware::class)]
final readonly class OrderController
{
    public function __construct(
        private CurrentUserInterface $user,
    ) {}

    #[Get('/orders')]
    public function index(): array
    {
        return ['userId' => $this->user->id()];
    }
}

Need opaque Bearer-token validation against your own storage instead? See kinetis/auth.

Installation

composer require kinetis/auth-jwt

Requires PHP 8.4+ and kinetis/framework. Full documentation: docs.kinetis.dev/auth-jwt.html.

License

MIT — see LICENSE.