jwt-auth (PHP Open Source Saver)

php-open-source-saver/jwt-auth adds JSON Web Token (JWT) authentication to Laravel and Lumen applications. It is a community-maintained fork of the popular but stalled tymondesigns/jwt-auth, preserving the same API while continuing support for modern Laravel versions and PHP releases.

It provides a JWT auth guard, token issuance and parsing, refresh and invalidation, a token blacklist, and middleware for protecting API routes. Migration from the original Tymon package is largely a namespace swap.

What You Get

• A jwt auth guard that authenticates users from a bearer token
• Token issuance, parsing, refresh, and invalidation helpers
• A token blacklist to revoke tokens before they expire
• Middleware for protecting and refreshing tokens on API routes
• Drop-in migration path from tymondesigns/jwt-auth via namespace replacement

Common Use Cases

• Securing stateless REST APIs for single-page and mobile apps
• Issuing and refreshing access tokens on user login
• Revoking compromised or logged-out tokens via the blacklist
• Migrating an existing Tymon jwt-auth project to a maintained package

Under The Hood

Architecture

The package registers an AbstractServiceProvider that binds the JWT factory, payload factory, blacklist, and token parsers into Laravel’s container, and adds a JWTGuard implementing Laravel’s Guard contract. Tokens are built by a payload/claims factory, signed through a pluggable provider (lcobucci/jwt by default), and parsed from the request by a chain of parsers (Authorization header, query string, cookie, etc.). A Blacklist backed by the cache tracks invalidated tokens, and middleware classes enforce authentication and handle refresh flows.

Tech Stack

100% PHP targeting Laravel and Lumen across current versions, distributed via Composer. It builds on the lcobucci/jwt library for token encoding/decoding and integrates with Laravel’s auth, cache, and config subsystems. Tests run under PHPUnit.

Code Quality

Inherited from a battle-tested codebase with over 1,900 commits and 100+ contributors, the fork adds active maintenance, security policy, and continuous integration. The src/ tree separates Guards, Providers, Claims, Http parsers, and Middleware, and the project ships extensive documentation on Read the Docs.

API Design

The developer experience is well established: helper facade JWTAuth, auth('api') guard methods like attempt(), refresh(), and invalidate(), and artisan-published config. Because it mirrors the original Tymon API, the large existing body of tutorials applies. The main caveat is one breaking change — JWTGuard now requires an event dispatcher — noted in the migration guide.