quioteframework/auth-jwt

Bearer/JWT resource-server authentication (JWS verification, JWKS, RFC 9068 client-type resolution) for Quiote, built on firebase/php-jwt.

v3.1.0 2026-07-29 21:45 UTC

Requires

• php: >=8.5.0
• firebase/php-jwt: ^7.1
• psr/cache: ^3.0
• psr/http-client: ^1.0
• psr/http-factory: ^1.1
• quioteframework/auth: *
• quioteframework/quiote: *

MIT

• Quiote Contributors

• security
• oauth
• auth
• jwt
• quiote

Published on Packagist.org on 2026-07-29 22:10 UTC

README

Bearer/JWT resource-server authentication for Quiote, built on firebase/php-jwt. Verifies a JWS (shared HS256 secret, or RS256/ES256 via a JWKS-backed CachedKeySet), enforces iss/aud, and derives human-vs-machine client type per RFC 9068. Requires quioteframework/auth for the shared AuthenticatorInterface/Passport/UserProviderInterface contracts.

Install

composer require quioteframework/auth-jwt

Enable

Register Quiote\Security\Auth\JwtAuthPlugin (registers the default ClientTypeResolverInterface). TokenValidatorInterface/BearerTokenAuthenticator need app-specific secrets (issuer, audience, JWKS URI or shared key), so construct and register those yourself — typically alongside a FirewallMap built with quioteframework/auth's FirewallFactory.

License

MIT. See LICENSE.