bencolmer/laravel-fit-validator

Validate Atlassian Forge Invocation Tokens (FITs) in Laravel

1.0.0 2026-02-01 22:28 UTC

Requires

• php: ^8.1
• firebase/php-jwt: ^7.0
• guzzlehttp/guzzle: ^7.10
• illuminate/contracts: ^10.0|^11.0|^12.0
• illuminate/http: ^10.0|^11.0|^12.0
• illuminate/support: ^10.0|^11.0|^12.0

Requires (Dev)

• orchestra/testbench: ^8.0|^9.0|^10.0
• phpunit/phpunit: ^10.0|^11.0|^12.0

MIT

• Ben Colmer

• laravel
• atlassian
• Fit
• forge

README

This package allows you to validate and use Atlassian Forge Invocation Tokens (FITs) in Laravel.

Installation

1. Install the package via composer:

composer require bencolmer/laravel-fit-validator

1. Configure .env values:

FIT_APP_ID="example:id::app/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx" # The ID of your Forge application
FIT_JWKS_URL="https://forge.cdn.prod.atlassian-dev.net/.well-known/jwks.json" # The JWKS URL for your Forge application

1. Add the fit middleware to any routes that should validate Forge Invocation Tokens.

Route::middleware('fit')->group(function () {
    //
});

Token Usage

The fit middleware will validate the Forge Invocation Token and add the validated payload to the request input array.

Example:

// in routes/api.php

Route::middleware('fit')->group(function () {
    Route::get('example', [ExampleController::class, 'index']);
});

// in app/Http/Controllers/ExampleController.php

use Illuminate\Http\Request;

class JiraController extends Controller
{
    public function index(Request $request)
    {
        $fit = $request->input('fit');

        // ...
    }
}

Advanced Usage

You can configure the package validate FIT tokens from multiple Forge applications:

1. Publish package configuration

php artisan vendor:publish --provider="BenColmer\LaravelFITValidator\Providers\ServiceProvider"

1. Add your Forge application details to the applications array in config/fit.php:

// ...

'applications' => [
    // ...

    // details for your other application
    'otherApp' => [
        'appId' => (string) env('FIT_OTHER_APP_ID', ''),
        'jwksUrl' => (string) env('FIT_OTHER_JWKS_URL', ''),
    ]
],

1. Update the fit middleware to use the configuration for your new application

// in routes/api.php

Route::middleware('fit')->group(function () {
    // validate FITs using the "default" application config
});

Route::middleware('fit:otherApp')->group(function () {
    // validate FITs using the "otherApp" application config
});

Testing

Run tests via PHPUnit:

./vendor/bin/phpunit

Credits

• Ben Colmer

License

Laravel FIT Validator is open-sourced software licensed under the MIT license.