How to Generate a JWT

The general process is:

Step 1: Authenticate the User

Verify the user's credentials from the database.

Step 2: Create the Payload

Include essential claims such as:

• User ID
• Email
• Role
• Issued At (iat)
• Expiration Time (exp)

Step 3: Sign the Token

Use a secure secret key (or RSA private key) with algorithms like:

• HS256
• HS384
• HS512
• RS256

Step 4: Return the Token

Send the generated JWT to the client after successful login.

Example response:

{
    "access_token":"eyJhbGc...",
    "expires_in":3600
}

How to Validate a JWT

Whenever a client sends a request, the server validates the JWT.

Validation includes:

1. Verify Signature

Ensure the token hasn't been modified.

2. Check Expiration

Reject expired tokens.

3. Verify Issuer

Validate the iss claim.

4. Verify Audience

Ensure the token is intended for your application.

5. Validate Custom Claims

Verify user roles, permissions, tenant IDs, or other business-specific claims.

If every validation succeeds, the request is authenticated.

JWT Authentication Flow

1. User logs in.
2. Server verifies credentials.
3. Server generates a JWT.
4. Client stores the token securely.
5. Client sends the token in the Authorization header.
6. Server validates the token.
7. Server returns the requested resource.

Best Practices for JWT Security

• Always use HTTPS.
• Keep token expiration short.
• Store refresh tokens securely.
• Never expose your secret key.
• Use strong signing algorithms such as HS256 or RS256.
• Validate every incoming token.
• Include only necessary information in the payload.
• Rotate signing keys periodically.
• Implement token revocation when required.

Common JWT Errors

• Invalid signature
• Expired token
• Incorrect issuer
• Invalid audience
• Malformed token
• Missing Authorization header

Proper error handling helps improve both security and user experience.

Advantages of JWT

• Stateless authentication
• Scalable for distributed systems
• Compact and URL-safe
• Easy integration with APIs
• Supports cross-platform applications
• Reduces server-side session storage

Installation

composer require firebase/php-jwt

1. Generate a JWT (HS256 - Symmetric)

<?php

require_once __DIR__ . '/vendor/autoload.php';

use Firebase\JWT\JWT;

$secretKey = 'your-super-secret-key-here-make-it-long-and-random'; // Store in .env!
$algorithm = 'HS256';

$payload = [
    'iss'  => 'https://yourdomain.com',     // Issuer
    'sub'  => 'user123',                    // Subject (user ID)
    'aud'  => 'https://yourdomain.com',     // Audience
    'iat'  => time(),                       // Issued at (Unix timestamp)
    'exp'  => time() + (3600),              // Expiration time (1 hour)
    'name' => 'John Doe',
    'role' => 'admin'
];

$jwt = JWT::encode($payload, $secretKey, $algorithm);

echo "Generated Token:\n" . $jwt . "\n";

2. Validate / Decode a JWT

<?php

require_once __DIR__ . '/vendor/autoload.php';

use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Firebase\JWT\ExpiredException;
use Firebase\JWT\SignatureInvalidException;

$secretKey = 'your-super-secret-key-here-make-it-long-and-random';
$algorithm = 'HS256';

$token = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
$token = str_replace('Bearer ', '', $token);   // Remove "Bearer " prefix if present

try {
    $decoded = JWT::decode($token, new Key($secretKey, $algorithm));

    // Successfully validated
    $payload = (array) $decoded;
    echo "Valid Token! Payload:\n";
    print_r($payload);

} catch (ExpiredException $e) {
    http_response_code(401);
    echo json_encode(['error' => 'Token has expired']);
} catch (SignatureInvalidException $e) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
} catch (\Exception $e) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid token: ' . $e->getMessage()]);
}

Using RS256 (Asymmetric – Better for production)

Generate keys (one-time):

openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048
openssl rsa -in private.key -pubout -out public.key

Generate token (with private key):

$privateKey = file_get_contents(__DIR__ . '/private.key');
$jwt = JWT::encode($payload, $privateKey, 'RS256');

Validate token (with public key):

$publicKey = file_get_contents(__DIR__ . '/public.key');
$decoded = JWT::decode($token, new Key($publicKey, 'RS256'));