acat/jwt

Validates, decodes, and authorizes tokens (e.g. JWT)

dev-main 2026-07-24 11:36 UTC

Requires

• php: >=8.4
• lcobucci/jwt: ^5.5.0
• phpseclib/phpseclib: ~3.0
• psr/clock: ^1.0
• psr/log: ^3.0.2

Requires (Dev)

• phpunit/phpunit: ^12.2.7

MIT

Published on Packagist.org on 2026-07-24 11:36 UTC

README

Decodes and verifies RSA-signed JWTs (e.g. from a Keycloak realm) and authorizes them against a required issuer, resource and role.

Requirements

PHP 8.4 and later.

Installation

You can install the library via Composer. Run the following command:

composer require acat/jwt

Usage

use ACAT\JWT\TokenDecoder;
use ACAT\JWT\TokenAuthorizer;

$decoder = new TokenDecoder('https://auth.example.com', 'my-realm');
$token = $decoder->decodeToken($jwt); // verifies signature, exp/nbf/iat via the realm's JWKS

$authorizer = new TokenAuthorizer();
$authorizer->authorize($token, 'my-client', 'https://auth.example.com/realms/my-realm', 'admin');

decodeToken() fetches the signing key from the realm's JWKS endpoint (matched by the token's kid header), verifies the signature and validates exp/nbf/iat. authorize() additionally checks the token's issuer and, if a role is given, that the role is present under resource_access.<resourceName>.roles. Both throw ACAT\JWT\Exception\TokenException on failure.

Testing

composer install
vendor/bin/phpunit