webservco / jwt

v2.3.0 2026-10-11 16:34 UTC

Requires

• php: ^8.4
• firebase/php-jwt: ^7
• webservco/data: ^2

Requires (Dev)

• pds/skeleton: ^1
• phan/phan: ^6
• php-parallel-lint/php-console-highlighter: ^1
• php-parallel-lint/php-parallel-lint: ^1
• phpmd/phpmd: ^3
• phpstan/phpstan: ^2
• phpstan/phpstan-deprecation-rules: ^2
• phpstan/phpstan-phpunit: ^2
• phpstan/phpstan-strict-rules: ^2
• phpunit/phpunit: ^13
• slevomat/coding-standard: ^8
• squizlabs/php_codesniffer: ^4
• vimeo/psalm: ^6
• webservco/coding-standards: ^2
• webservco/component-common: ^2

MIT

• Radu Maier

• component
• webservco

Published on Packagist.org on 2026-10-11 16:42 UTC

README

A PHP component/library. Please see webservco/sandbox for an example project using these types of components.

Decodes and verifies an HS256 JSON Web Token and returns its issuer and subject.

• Requires: firebase/php-jwt (installed with this package), a shared secret
• Related: webservco/jsonapi-application (API endpoints usually protected by a token)

Installation

composer require webservco/jwt

Usage

use WebServCo\JWT\Service\DecoderService;

// \WebServCo\JWT\Contract\DecoderServiceInterface
$decoderService = new DecoderService($configurationGetter->getString('JWT_SECRET'));

// The token from the "Authorization: Bearer <token>" header.
// \WebServCo\JWT\DataTransfer\Payload
$payload = $decoderService->decodeJwt($token);

$userId = $payload->sub;
$issuer = $payload->iss;

The webservco/sandbox project does this in its ApiAuthenticationMiddleware, and then sets the user ID as a request attribute.

Contracts

Interface	Implementation	Purpose
Contract\DecoderServiceInterface	Service\DecoderService	Verifies the signature and returns the payload.
none	DataTransfer\Payload	Readonly iss and sub.

Namespaces are relative to WebServCo\JWT\.

Configuration

The secret can come from anywhere. The sandbox project reads it from:

[API]

JWT_SECRET = a-long-random-string

Notes

Only HS256 is accepted. An invalid signature, an expired token or a malformed token throws the exceptions from firebase/php-jwt. A token without iss or sub throws an UnexpectedValueException.

To create a test token, use the debugger on jwt.io with the same secret.

Development

# Start project.
ddev start
# Install dependencies.
ddev c u
# Run all validations.
ddev c c
# Run unit tests.
ddev c test:dox

License

MIT