aetah/jose

Generic PHP library for JOSE and compact JWS processing primitives

0.1.0 2026-06-21 13:28 UTC

Requires

• php: ^8.3

Requires (Dev)

• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^12.1
• squizlabs/php_codesniffer: ^4.0

AGPL-3.0-or-later

README

This repository is a read-only split of aetah/php-openid-toolkit.

• Development happens in the monorepo.
• Feature PRs and issues should be opened against aetah/php-openid-toolkit.
• This split repository is published from the monorepo and should not be treated as the source of truth.

JOSE

Generic PHP library for low-level JOSE and compact JWS processing primitives.

Scope

This package is designed as a reusable base for aetah/* libraries and CMS integrations. It provides:

• base64url helpers for JOSE payloads
• compact JWS parsing into typed header/payload/signature data
• signing helpers for HS*, RS*, and EdDSA
• verification helpers for PEM keys, shared secrets, JWKs, and JWKS sets
• RSA JWK to PEM conversion for public-key verification

The package intentionally leaves token profile validation, claim policy, discovery, key persistence, and HTTP endpoint orchestration to host applications.

Install

composer require aetah/jose

Quick Start

<?php

declare(strict_types=1);

use Aetah\JOSE\JOSE;

$jose = new JOSE();

$jwt = $jose->sign(
    claims: ['sub' => '123', 'iss' => 'https://issuer.example'],
    algorithm: 'HS256',
    privateKey: 'shared-secret',
    kid: 'sig-1'
);

$parsed = $jose->verifyWithKey($jwt, 'shared-secret');

Spec

• JSON Web Signature (RFC 7515): https://www.rfc-editor.org/rfc/rfc7515
• JSON Web Key (RFC 7517): https://www.rfc-editor.org/rfc/rfc7517
• JSON Web Algorithms (RFC 7518): https://www.rfc-editor.org/rfc/rfc7518
• JSON Web Token (RFC 7519): https://www.rfc-editor.org/rfc/rfc7519

Spec Status

Missing/out of scope:

• JWE encryption and decryption
• X.509 certificate chain processing
• remote JWKS retrieval and caching
• OAuth or OpenID Connect claim validation profiles
• detached payload and general JSON serialization handling

Quality Checks

Run Static Analysis

composer analyse

Run Tests

composer test

Generated artifacts are written under build/:

• build/phpunit/ for JUnit reports
• build/coverage/ for coverage output

Clean Build Artifacts

composer clean

Run Test Coverage

composer test:coverage

Run Style Checks

composer lint

Fix Style Checks

composer lint:fix

License

Licensed under AGPL-3.0-or-later. See LICENSE for details.