The Jwt facade

use RoundlyConsulting\Jwt\Facades\Jwt;
use RoundlyConsulting\Jwt\UserTokens\AccessTokenRequest;

// Mint an access token with a fluent, self-documenting request.
$issued = Jwt::mintAccessToken(
    AccessTokenRequest::for($user->id)
        ->email($user->email, verified: $user->hasVerifiedEmail())
        ->tokenVersion($user->token_version)
        ->permissions('posts.view', 'posts.edit')
);

$claims = Jwt::verify($issued->token);   // RS256 + iss/aud pinned
Jwt::logout($issued);                     // denylist it (one-call logout)
$current = Jwt::guard('api')->claims();   // current request's claims on that guard, or null

// User tokens (RS256), for the configured jwt.audience
Jwt::mintAccessToken($request);  Jwt::mint($sub, $scope, $ttl, $claims, $aud);
Jwt::mintChallengeToken($sub);   Jwt::mintEmailVerifyToken($sub, $email);
Jwt::verify($jwt, ?$aud);

// One jwt guard — its own audience, settings and current claims
Jwt::guard('clients')->mintAccessToken($request);   // aud = the guard's audience
Jwt::guard('clients')->mint($sub, $scope, $ttl, $claims);
Jwt::guard('clients')->verify($jwt);
Jwt::guard('clients')->claims();      // ?Claims of the current request on that guard
Jwt::guard('clients')->settings();    // JwtGuardSettings
Jwt::guard('clients')->audience();    // string

// Service tokens (HS256)
Jwt::services()->issue('billing', ['job' => 'sync']);
Jwt::services()->verify($jwt);
Jwt::services()->request('billing')->post(...);      // Http client with a fresh bearer
Jwt::services()->authenticate($pendingRequest, 'billing');
Jwt::services()->claims();            // ?Claims of the calling service (service-jwt guard)

// Denylist & logout
Jwt::denylist()->has($jti);  Jwt::denylist()->deny($jti, $until);  Jwt::denylist()->denyToken($issued);
Jwt::logout($issued);        Jwt::denyClaims($claims);

// Key publishing
Jwt::publicKey();   // RsaKey — the configured verification key
Jwt::jwks();        // ['keys' => [[kty, n, e, alg, use, kid?]]] — serve as /.well-known/jwks.json

Route::get('/.well-known/jwks.json', fn () => response()->json(Jwt::jwks()));