---
title: "JWT for Laravel — docs | Roundly"
description: "Developer docs for JWT for Laravel: RS256 user tokens, HS256 service tokens, jwt guards, jti denylist logout and claim-based authorization."
url: https://roundly-consulting.com/open-source/docs/jwt-for-laravel
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

Open source

# JWT for Laravel

Install

`composer require roundly-consulting/jwt-for-laravel`

Requires: PHP ^8.4 · Laravel ^12.0|^13.0

[GitHub](https://github.com/roundly-consulting/jwt-for-laravel) [Packagist](https://packagist.org/packages/roundly-consulting/jwt-for-laravel) [Donate (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Patreon](https://www.patreon.com/cw/roundly)

## Overview

Native JSON Web Tokens for Laravel. Mint RS256 user tokens on your login app and verify them offline in every other service with only the public key; sign short-lived HS256 service tokens for machine-to-machine calls. Drop-in jwt and service-jwt guards, a self-evicting jti denylist and claim-based authorization plug straight into Laravel’s auth. MIT-licensed, with zero third-party crypto — the JOSE core runs on PHP’s own ext-openssl through our audited crypto-for-laravel.

### What you get

#### RS256 user tokens

Mint on the issuer app that holds the private key; verify offline anywhere with only the public PEM.

#### HS256 service tokens

Short-lived machine-to-machine tokens with shared or per-issuer secrets, plus a helper for outbound HTTP calls.

#### Drop-in guards

jwt and service-jwt drivers for config/auth.php — claims mode or Eloquent provider mode, several guards isolated by audience.

#### One-call logout

A cache-backed jti denylist that evicts itself at exp + leeway, plus token versions to log a user out everywhere.

#### Claim-based authorization

Permissions baked into the token feed Laravel’s Gate — can() checks with no database query.

#### Hardened, zero third-party crypto

Algorithm pinning, constant-time HMAC, key-size checks and mandatory iss/aud pins — on PHP’s own ext-openssl via our crypto-for-laravel.

#### Facade, DI & a recording fake

Jwt::guard() and Jwt::services() handles, an injectable JwtManager, and Jwt::fake() with in-memory keys, actingAs() and actingAsService().

### Documentation

#### [Installation](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/installation.md)

Install via Composer, publish the config and generate an RSA keypair on issuer apps — verify-only apps need just the public key.

#### [Configuration](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/configuration.md)

Every config/jwt.php key with its env var and default — keys, pins, lifetimes, guard defaults, denylist and service tokens.

#### [The Jwt facade](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/jwt-facade.md)

One entry point to mint, verify and log out, with Jwt::guard() and Jwt::services() handles, JWKS publishing and a recording fake.

#### [DI and actions](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/without-facade.md)

Skip the facade: inject JwtManager for the same API without static calls, or resolve the contracts behind it — there are no action classes.

#### [Minting user tokens](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/user-tokens.md)

Mint RS256 access tokens with the fluent AccessTokenRequest, plus challenge, email-verify and custom-scope tokens.

#### [Verifying tokens](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/verifying-tokens.md)

Verify RS256 user tokens offline with only the public key, read claims through typed accessors and handle failures.

#### [Guards](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/guards.md)

Wire the jwt and service-jwt guard drivers — claims mode or Eloquent provider mode, the request pipeline and token-version checks.

#### [Multiple guards](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/multiple-guards.md)

Run several jwt guards — users, clients — each isolated by its own audience, with per-guard scope, identity and denylist options.

#### [Service tokens](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/service-tokens.md)

Short-lived HS256 machine-to-machine tokens: issue them, attach them to outbound HTTP calls, pick a secret mode and verify inbound calls.

#### [Logout & denylist](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/logout-denylist.md)

Log users out by denylisting a token’s jti — a cache-backed store that evicts each entry once the token can no longer verify.

#### [Claim-based authorization](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/claim-authorization.md)

Grant abilities straight from the token’s permissions claim through Laravel’s Gate — can() checks with no database query.

#### [Events](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/events.md)

Four lifecycle events — user and service token issued, verification failed, token denied — with safe metadata only.

#### [Artisan commands](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/commands.md)

Generate a 2048-bit RSA keypair with jwt:generate-keys and inspect the token setup with php artisan about.

#### [Security model](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/security.md)

What the package enforces for you — algorithm pinning, key and secret strength, mandatory pins, size caps and fail-closed defaults.

#### [Exceptions](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/exceptions.md)

The JwtException hierarchy for token failures, and the misconfiguration exceptions that surface as a 500 instead of a 401.

#### [Extending](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/extending.md)

Rebind any contract — issuer, verifier, service tokens, denylist — and plug in your own claims-mode identity class.

#### [Testing](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/testing.md)

Jwt::fake() records every mint, service token and deny over in-memory keys, with actingAs() and actingAsService() — or use a real keypair.

#### [Requirements](https://roundly-consulting.com/open-source/docs/jwt-for-laravel/requirements.md)

PHP 8.4+, Laravel 12 or 13, and the ext-openssl and ext-json extensions. Composer pulls in the crypto, enums and package toolkit packages.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source.md)