Artisan commands

jwt:generate-keys

php artisan jwt:generate-keys          # writes both PEMs; refuses to overwrite
php artisan jwt:generate-keys --force  # overwrite existing keys

• Writes the keys to jwt.private_key_path and jwt.public_key_path — by default storage/jwt-private.key and storage/jwt-public.pem. It fails with a clear error if either path is not set (null or blank).
• Refuses to overwrite existing keys without --force, so you can’t clobber live keys.
• Creates missing parent directories and resolves relative paths from the application root. It needs write access to each key’s directory and refuses to replace a key path that isn’t a writable file.
• Writes both keys to temp files beside their targets and renames them into place only after both writes succeed: the private key is 0600 (owner-only) from its first byte, the public key 0644.
• With --force a replaced key is a new file, so a process that holds the old private key open never reads the new one through that handle.
• Every filesystem failure — an unwritable or uncreatable directory, a read-only key file, a directory at a key path — ends in the command’s own error naming the path and a FAILURE exit, never a stack trace. A failed run leaves an existing pair untouched; only if the public key can’t be moved into place after the private one does it report that the pair no longer matches — fix the permissions and re-run with --force.

Copy the public key to every verify-only service’s JWT_PUBLIC_KEY_PATH; keep the private key on the issuer.

php artisan about

php artisan about --only=jwt

The package adds a Jwt section reporting the algorithms, whether the signing and verification key files exist (SET / MISSING), whether the issuer and audience are SET or MISSING, the access-token TTL, the service-token mode (per-issuer secrets, shared secret or no secret) and whether the denylist check and claim authorization are ON. It never prints key material, secrets or key paths.