switon/jwt

HMAC JWT issue, validation, and optional kid-based key routing for Switon Framework

v1.0.0 2026-06-06 13:43 UTC

Requires

• php: >=8.3
• switon/core: ^1.0
• switon/crypto: ^1.0

Requires (Dev)

• phpstan/extension-installer: ^1.4
• phpstan/phpstan: ^2.0
• switon/testing: ^1.0

MIT

• switon

• Authentication
• jwt
• tokens
• switon

README

Switon's JWT contract for application services that want HMAC-signed tokens, kid-based key selection, and exp/nbf checks.

Highlights

• Token issuing and validation: JwtInterface covers both sides of the JWT flow.
• Per-token signing keys: tokens can carry a key ID, and decode can use it to select the matching signing key.
• Claim policy: issued tokens get consistent exp and nbf claims.
• Validation policy: signatures and standard claim checks are enforced together.
• Clear failure types: invalid tokens surface as specific exceptions.

Installation

composer require switon/jwt

Quick Start

use Switon\Core\Attribute\Autowired;
use Switon\Jwt\JwtInterface;

class AuthService
{
    #[Autowired] protected JwtInterface $jwt;

    public function issueForTenant(int $userId, string $kid): string
    {
        return $this->jwt->encode(['user_id' => $userId], 3600, $kid);
    }

    public function authenticate(string $token, string $kid): array
    {
        return $this->jwt->decode($token, $kid);
    }
}

Docs: https://docs.switon.dev/latest/jwt

License

MIT.