Download the PHP package daycry/jwt without Composer
On this page you can find all versions of the php package daycry/jwt. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package jwt
Short Description JWT Token for Codeigniter 4
License MIT
Homepage https://github.com/daycry/jwt
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package jwt
JWT for CodeIgniter 4
A JWT (JSON Web Token) library for CodeIgniter 4, built on top of lcobucci/jwt ^5. Supports HMAC, RSA and ECDSA, an immutable façade, and key rotation.
📖 Full documentation: https://daycry.github.io/jwt/ — this README is a quick overview; the site has the complete, searchable reference.
Package
Quality
Community
Requirements
- PHP 8.2 or higher
- CodeIgniter 4.x
lcobucci/jwt ^5.5
Upgrading from v2.x? Read the v2 → v3 migration guide.
Installation
Publish the configuration file
Generate a signing key
The key is written automatically to .env as jwt.signer. Use --show to print it without touching the file.
⚠️ Never commit
.envto version control.
Quick Start
The library throws
JWTConfigurationExceptionifjwt.signer,jwt.issuer,jwt.audience, orjwt.identifieris missing — bothnulland an empty string""are rejected. Defaults are intentionallynullto fail loudly.
Configuration
After publishing, edit app/Config/JWT.php. All properties are inherited from Daycry\JWT\Config\JWT and overridable via .env.
HMAC (default)
RSA / ECDSA
In app/Config/JWT.php set the signer class:
See docs/configuration.md for the full reference.
Usage
Compact array payload (default)
Split mode — claims at the top level
Custom payload claim name
Short-lived tokens (withExpiresAt)
Override the configured expiresAt modifier for a single instance, without mutating the shared config — useful for short-lived access tokens. Like every with*() method it returns a new instance. Passing an empty string throws InvalidArgumentException.
Clock skew tolerance (LooseValidAt)
withLeeway() accepts null to reset to "no leeway"; a negative value throws InvalidArgumentException.
Per-instance customisers (3.2.0)
Every customiser returns a new instance, leaving the shared config untouched. Override claims, audiences, headers and extra claims per call:
Key rotation with kid (3.2.0)
Tag issued tokens with a kid header and verify against a per-kid key map, so you can roll keys without invalidating tokens still in flight:
On decode, the token's kid selects the matching key from $verifyingKeys (falling back to $verifyingKey / $signer). The configured signer/algorithm is always used, so a token's kid can never downgrade the verifier.
Error Handling
For a non-throwing flow:
Fail-closed configuration guards
The library refuses unsafe configurations up front instead of silently producing weak tokens. JWTConfigurationException is thrown when:
jwt.validateClaimsdoes not contain'SignedWith'whilejwt.validate = true—decode()will not skip signature verification. To decode without any validation, setjwt.validate = false(intended for tests/debug only;decode()then logs awarning).jwt.algorithmTypeandjwt.algorithmdisagree —'symmetric'requires anLcobucci\JWT\Signer\Hmac\*signer,'asymmetric'requiresRsa\*orEcdsa\*. (E.g. leaving the default HMACSha256on an'asymmetric'type is caught with a clear message instead of a cryptic key error.)
An invalid jwt.canOnlyBeUsedAfter or jwt.expiresAt modifier (anything DateTimeImmutable::modify() rejects) throws InvalidArgumentException consistently across PHP versions.
Utility Methods
| Method | Returns | Description |
|---|---|---|
decode(string $token) |
Plain |
Validates and returns the parsed token. Throws on failure. |
tryDecode(string $token) |
?Plain |
Like decode() but returns null on a token failure. A JWTConfigurationException (misconfiguration) still propagates. |
getPayload(string $token) |
mixed |
Validates + returns the original payload (auto-decoded for compact mode). |
getClaims(string $token) |
array |
Validated array of all claims (the safe counterpart of extractClaimsUnsafe()). |
getClaim(string $token, string $name) |
mixed |
Validated single claim value (null when absent). |
isValid(string $token) |
bool |
True iff tryDecode() succeeds. |
isExpired(string $token) |
bool |
True for malformed/expired tokens. Parses without verifying the signature — never gate access on it. |
getTimeToExpiry(string $token) |
?int |
Seconds until exp, or null. Does not verify the signature. |
extractClaimsUnsafe(string $token) |
?array |
Claims without validation. Logs a warning unless Config::$allowUnsafeExtraction = true. |
CLI Commands
On Windows,
jwt:keypairwarns thatchmod()cannot enforce file permissions — restrict the private key with NTFS ACLs (e.g.icacls) instead. It also warns when--passphraseis passed on the command line, because that value can leak via the process list and shell history; prefer a secrets manager or interactive entry.
Security Best Practices
- Use a strong key —
php spark jwt:keyenforces a 32-byte (256-bit) minimum, the floor for HS256. - Set short expiry times for API access tokens (
withExpiresAt('+15 minutes')). - Enable all validation constraints in production (keep
'SignedWith'injwt.validateClaims). - Never commit
.envor any file containingjwt.signer/ private keys. - Rotate keys without downtime using the
kidheader andjwt.verifyingKeysmap (see Key rotation) — keep the old key in the map until its tokens have expired, then drop it. If a key is leaked, remove it from the map immediately to revoke its tokens.
Testing
Documentation
📖 The full, searchable documentation is published at https://daycry.github.io/jwt/ (built with MkDocs Material from the docs/ folder).
| Document | Description |
|---|---|
| Getting Started | Installation and first token in minutes |
| Configuration | Every property, its type, default, and .env key |
| Usage | Complete API reference with examples |
| Advanced | Utility methods, key rotation, middleware, multi-tenant patterns |
| CLI Commands | jwt:key, jwt:keypair, jwt:publish reference |
| Threat Model | Security model and guarantees |
| Testing | Test suite structure and writing new tests |
| Migration v2 → v3 | Upgrade guide |
Contributing
- Fork the repository
- Create a feature branch:
git checkout -b feature/my-feature - Commit your changes:
git commit -m 'Add my feature' - Push and open a Pull Request
License
MIT — see LICENSE.
Support
- 🐛 Open an issue for bug reports or feature requests
- 💰 Donate via PayPal
All versions of jwt with dependencies
lcobucci/clock Version ^3.0
lcobucci/jwt Version ^5.5
psr/clock Version ^1.0