lcobucci/jwt

lcobucci/jwt is a widely-used PHP library for working with JSON Web Tokens (JWT) and JSON Web Signatures (JWS), implementing RFC 7519. It provides a fluent builder for constructing tokens, a parser for reading them back, and a validation API for verifying claims and signatures.

The library supports the common HMAC, RSA, and ECDSA signing algorithms via PHP’s OpenSSL and Sodium extensions, and exposes a JwtFacade for the common encode/decode case as well as lower-level Builder/Parser/Validator classes for applications that need finer control over claim handling, custom validation constraints, or clock injection for testable expiry checks.

What You Get

• A fluent Builder API for constructing tokens with standard and custom claims
• A Parser for decoding tokens back into typed claim objects
• A Validator with composable constraints (signature, expiry, issuer, audience, etc.)
• Signer implementations for HMAC (HS256/384/512), RSA (RS256/384/512), and ECDSA (ES256/384/512)
• A JwtFacade convenience wrapper and a PSR-20 Clock integration for deterministic expiry testing

Common Use Cases

• Issuing and verifying access/refresh tokens for a stateless API authentication scheme
• Signing tokens for service-to-service authentication in a microservices architecture
• Implementing custom SSO or session tokens with app-specific claims
• Validating third-party JWTs (e.g. OIDC ID tokens) against issuer, audience, and expiry constraints

Under The Hood

Architecture - The library separates concerns cleanly into Builder/Encoder (token construction), Parser/Decoder (token reading), Token/ (typed claim/header value objects), Signer/ (algorithm implementations), and Validation/ (composable constraint objects evaluated by a central Validator), with JwtFacade wiring these together for the common issue-and-verify path. Tech Stack - Modern PHP (8.4/8.5 only in the current major), relying on the ext-openssl and ext-sodium extensions for RSA/ECDSA and EdDSA-family signing plus a SodiumBase64Polyfill for portability, and psr/clock (^1.0) so expiry validation can be driven by an injected clock instead of time(). Code Quality - 65 test files exercise builders, parsers, every signer, and each validation constraint independently; CI runs PHPUnit with code coverage tracked via Codecov, and the codebase requires a very recent PHP version, reflecting an actively-maintained, forward-looking major version (6.x) rather than broad backward compatibility. API Design - The fluent Builder/Validator APIs read naturally ($builder->issuedBy(...)->withClaim(...), $validator->validate($token, ...constraints)), and typed claim/header objects surface type errors at static-analysis time rather than as runtime array-key surprises, though the split between the low-level classes and JwtFacade means new users must pick the right entry point for their use case.