---
title: "Artisan commands — JWT for Laravel | Roundly"
description: "Generate a 2048-bit RSA keypair with jwt:generate-keys and inspect the token setup with php artisan about."
url: https://roundly-consulting.com/open-source/docs/jwt-for-laravel/commands
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[JWT for Laravel](https://roundly-consulting.com/open-source/docs/jwt-for-laravel.md)

# Artisan commands

## jwt:generate-keys

```bash
php artisan jwt:generate-keys          # writes both PEMs; refuses to overwrite
php artisan jwt:generate-keys --force  # overwrite existing keys
```

- Writes the keys to jwt.private\_key\_path and jwt.public\_key\_path — by default storage/jwt-private.key and storage/jwt-public.pem. It fails with a clear error if either path is not set (null or blank).
- Refuses to overwrite existing keys without --force, so you can’t clobber live keys.
- Creates missing parent directories and resolves relative paths from the application root. It needs write access to each key’s directory and refuses to replace a key path that isn’t a writable file.
- Writes both keys to temp files beside their targets and renames them into place only after both writes succeed: the private key is 0600 (owner-only) from its first byte, the public key 0644.
- With --force a replaced key is a new file, so a process that holds the old private key open never reads the new one through that handle.
- Every filesystem failure — an unwritable or uncreatable directory, a read-only key file, a directory at a key path — ends in the command’s own error naming the path and a FAILURE exit, never a stack trace. A failed run leaves an existing pair untouched; only if the public key can’t be moved into place after the private one does it report that the pair no longer matches — fix the permissions and re-run with --force.

Copy the public key to every verify-only service’s JWT\_PUBLIC\_KEY\_PATH; keep the private key on the issuer.

## php artisan about

```bash
php artisan about --only=jwt
```

The package adds a Jwt section reporting the algorithms, whether the signing and verification key files exist (SET / MISSING), whether the issuer and audience are SET or MISSING, the access-token TTL, the service-token mode (per-issuer secrets, shared secret or no secret) and whether the denylist check and claim authorization are ON. It never prints key material, secrets or key paths.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/jwt-for-laravel.md)