### Install JWT for Laravel with Composer and generate keys

Source: https://github.com/roundly-consulting/jwt-for-laravel/blob/main/README.md

Run these commands to install the package and generate the private and public keys. Requires PHP 8.4 with ext-openssl and ext-json, and Laravel 12 or 13. The key generation command writes storage/jwt-private.key and storage/jwt-public.pem.

```bash
composer require roundly-consulting/jwt-for-laravel
php artisan jwt:generate-keys   # issuer apps: writes storage/jwt-private.key + storage/jwt-public.pem
```

--------------------------------

### Configure JWT guard in config/auth.php

Source: https://github.com/roundly-consulting/jwt-for-laravel/blob/main/README.md

Declare a guard using the 'jwt' driver. The provider is optional; omitting it builds a TokenUser from the claims alone.

```php
'guards' => [
    'api' => ['driver' => 'jwt', 'provider' => 'users'],   // drop the provider to build a TokenUser from the claims alone
],
```

--------------------------------

### Mint, verify, and revoke JWT tokens

Source: https://github.com/roundly-consulting/jwt-for-laravel/blob/main/README.md

Use the Jwt facade to mint an access token with claims, verify it (RS256 with iss and aud pinned), and revoke it by denylisting the jti until expiry.

```php
use RoundlyConsulting\Jwt\Facades\Jwt;
use RoundlyConsulting\Jwt\UserTokens\AccessTokenRequest;

$issued = Jwt::mintAccessToken(
    AccessTokenRequest::for($user->id)
        ->email($user->email, verified: true)
        ->permissions('posts.view', 'posts.edit')
);

$claims = Jwt::verify($issued->token);   // RS256, iss and aud pinned
$claims->string('sub');                  // "42"

Jwt::logout($issued);                    // denylist the jti until it expires
```

--------------------------------

### Protect routes with auth:api middleware

Source: https://github.com/roundly-consulting/jwt-for-laravel/blob/main/README.md

Apply the 'auth:api' middleware to a route to require a valid JWT. The route returns the authenticated user's ID.

```php
Route::middleware('auth:api')->get('/me', fn () => ['id' => auth()->id()]);
```