Multiple guards

Several account types — say users and clients, each with its own table — can each run on their own jwt guard. Every jwt guard resolves sub through its own provider, so give each guard its own audience; otherwise a users token with sub = 5 authenticates as client #5:

// config/auth.php
'guards' => [
    'users'   => ['driver' => 'jwt', 'provider' => 'users',   'audience' => env('JWT_USERS_AUDIENCE', 'app-users')],
    'clients' => ['driver' => 'jwt', 'provider' => 'clients', 'audience' => env('JWT_CLIENTS_AUDIENCE', 'app-clients')],
],

Per-guard keys

Each guard reads these optional keys from its own auth.guards.<name> array. An unset or blank key defers to the global value, while a present but unusable one — a non-string scope, an identity that isn’t a ClaimsAuthenticatable — throws JwtMisconfigured naming the key:

Minting and reading per guard

Mint for, verify against and read a specific guard with Jwt::guard($name):

$clients = Jwt::guard('clients');

$clients->mintAccessToken(AccessTokenRequest::for($client->id)); // aud = 'app-clients'
$clients->mint((string) $client->id, 'access', ttl: 900);        // any scope, for the guard's audience
$clients->verify($jwt);      // a users token fails here (ClaimMismatch)
$clients->audience();        // 'app-clients' — auth.guards.clients.audience, else jwt.audience
$clients->settings();        // JwtGuardSettings: guard, audience, scope, checkDenylist, identity, tokenVersion
$clients->claims();          // that guard's verified claims, or null — never another guard's

Jwt::guard() throws JwtMisconfigured for a guard that isn’t a jwt guard, and mintAccessToken() refuses a request that already names a different audience rather than silently re-addressing it. jwt.audience stays required — it is the default for every guard without its own audience. A token minted for one guard’s audience yields a 401 on every other guard.