Download the PHP package sopheak/sp-jwt-auth without Composer
On this page you can find all versions of the php package sopheak/sp-jwt-auth. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package sp-jwt-auth
SP JWT Auth
sopheak/sp-jwt-auth is a modular Laravel authentication package for first-party JWT APIs, rotating opaque refresh tokens, account security workflows, API keys, external identity links, and optional OAuth server mode.
The package owns authentication infrastructure. Your application still owns password login, registration, user creation, tenants, roles, UI, response shape, delivery templates, and business authorization policy.
Public package links:
- Documentation: sp-jwt-auth-docs.vercel.app
- Packagist: packagist.org/packages/sopheak/sp-jwt-auth
Features
| Feature | What it provides | Default | Guide |
|---|---|---|---|
| Core JWT | sp-jwt guard, signed access tokens, persisted jti, scopes and claims, refresh rotation, revocation, signing-key rotation, and JWKS |
Enabled | Core JWT |
| Token context and scopes | Tenant, company, device, session, impersonation, and custom-claim context; scope middleware | Enabled | Claims and scopes |
| MFA and OTP | MFA challenges and one-time codes delivered through your app's email or phone/SMS provider | Disabled | MFA and OTP |
| First-factor OTP | Passwordless sign-in and sign-up with OTP sent to an email address or phone number; rate limits and app-owned user creation | Disabled | First-factor OTP |
| Email verification | One-time, hashed email-verification tokens with app-owned delivery | Disabled | Email verification |
| Password reset | One-time, hashed reset tokens; your app retains password validation and persistence | Disabled | Password reset |
| JWT token endpoints | Optional HTTP endpoints for refresh rotation and session revocation | Disabled | Token endpoints |
| API keys | Scoped integration keys with HMAC validation, rotation, revocation, IP restrictions, and middleware | Disabled | API keys |
| Social authentication and external identity | Socialite, OIDC, and provider-profile normalization and storage for Google, GitHub, and other app-owned social-login flows | Disabled | External identity |
| OAuth server | Isolated OAuth storage with clients, consent, authorization code + PKCE, client credentials, revocation, introspection, and resource middleware | Disabled | OAuth server |
| Events, hooks, and middleware | Lifecycle events, token-context hooks, and middleware for JWT, API-key, and OAuth protection | Enabled | Events and hooks · Middleware |
Core package features
The enabled-by-default core gives first-party Laravel APIs a complete, auditable token lifecycle while leaving application-specific login and authorization decisions in your app.
- Laravel-native JWT authentication — register the
sp-jwtguard and protect routes with Laravel's standardauthmiddleware. - Signed, key-identified access tokens — issue RSA-signed JWTs with
kidand persistedjtivalues; publish public keys through JWKS and rotate signing keys without exposing private material. - Scoped, contextual claims — use
TokenContextto attach scopes and application-owned context such as company IDs, device IDs, session IDs, impersonation state, and custom claims. - Safe refresh-token rotation — refresh tokens are opaque
id.secretvalues; only an HMAC hash is stored. Rotation is transactional and can revoke a session or all user sessions when reuse is detected. - Explicit revocation controls — revoke a single access token, a session, a device, or every active session for a user.
- Extension points and observability — lifecycle events and
HookRegistryhooks let your app validate or enrich token context and react to issuing, refresh, revocation, and reuse detection. - Operational tooling — Artisan commands generate and rotate keys, inspect JWKS output, prune expired records, and validate the installation configuration.
Quick Start
Requires PHP ^8.3|^8.4|^8.5, Laravel ^12.0|^13.0, and RSA signing keys for the default RS256 setup.
Install, configure the API guard, and run migrations:
The setup command publishes config, generates local signing keys, and configures the Laravel api guard. If your config/auth.php is custom, add it manually:
Create login and refresh endpoints in your Laravel app. Your app owns credential validation; the package owns token issuing, refresh rotation, and token response formatting.
Call protected routes with the returned access token:
Documentation
For configuration, token claims, refresh and revocation, account-security workflows, API keys, external identity, OAuth server mode, middleware, and deployment guidance, visit the official sp-jwt-auth documentation.
License
This package is open-source software licensed under the MIT license.
