PHPackages                             facile-it/php-jose-verifier - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. facile-it/php-jose-verifier

ActiveLibrary[Authentication & Authorization](/categories/authentication)

facile-it/php-jose-verifier
===========================

JWT Token Verifier. A JWT verifier for access tokens, id tokens and others

1.0.0(2mo ago)5852.9k↓30.2%63MITPHPPHP ^8.2CI passing

Since Apr 8Pushed 2w ago3 watchersCompare

[ Source](https://github.com/facile-it/php-jose-verifier)[ Packagist](https://packagist.org/packages/facile-it/php-jose-verifier)[ RSS](/packages/facile-it-php-jose-verifier/feed)WikiDiscussions master Synced 2w ago

READMEChangelog (10)Dependencies (33)Versions (27)Used By (3)

Facile JOSE Verifier
====================

[](#facile-jose-verifier)

A library to validate JWT tokens.

[![Build Status](https://github.com/facile-it/php-jose-verifier/workflows/Continuous%20Integration/badge.svg?branch=master)](https://github.com/facile-it/php-jose-verifier/actions)[![codecov](https://camo.githubusercontent.com/ea5b162f729f627d722bb717953863005f0dffd4ebb7b3a2e8c5d93de9930fa5/68747470733a2f2f636f6465636f762e696f2f67682f666163696c652d69742f7068702d6a6f73652d76657269666965722f6272616e63682f6d61737465722f67726170682f62616467652e7376673f746f6b656e3d31524853304e5744324c)](https://codecov.io/gh/facile-it/php-jose-verifier)[![Latest Stable Version](https://camo.githubusercontent.com/a03e8c29b8b6ade58cd7110e41850b1279496070577f53c655af8293b6ea6671/68747470733a2f2f706f7365722e707567782e6f72672f666163696c652d69742f7068702d6a6f73652d76657269666965722f762f737461626c65)](https://packagist.org/packages/facile-it/php-jose-verifier)[![Total Downloads](https://camo.githubusercontent.com/ee749c3081eb926c0a5c59a33cd18e048f2804a11edf7e2fef0a33de5435f20b/68747470733a2f2f706f7365722e707567782e6f72672f666163696c652d69742f7068702d6a6f73652d76657269666965722f646f776e6c6f616473)](https://packagist.org/packages/facile-it/php-jose-verifier)[![Latest Unstable Version](https://camo.githubusercontent.com/14a24ca71fc1c83619d98b53e3de3d24cb4fcd28e8eebf6a45c28db73c339d03/68747470733a2f2f706f7365722e707567782e6f72672f666163696c652d69742f7068702d6a6f73652d76657269666965722f762f756e737461626c65)](https://packagist.org/packages/facile-it/php-jose-verifier)[![License](https://camo.githubusercontent.com/6b324478fc8013d85c7fa012008fd64f3cb0423bb6d19e0842d6ff0913df6b81/68747470733a2f2f706f7365722e707567782e6f72672f666163696c652d69742f7068702d6a6f73652d76657269666965722f6c6963656e7365)](https://packagist.org/packages/facile-it/php-jose-verifier)

How To Use
----------

[](#how-to-use)

The suggested and simply way to use it (specially for OAuth2 and OpenID tokens) is using builders.

For better performance you should install `ext-gmp`.

Create verifiers from Issuer and Client Metadata
------------------------------------------------

[](#create-verifiers-from-issuer-and-client-metadata)

Usually an OpenID provider provides an openid-configuration (`/.well-known/openid-configuration`).

You can fetch the configuration and use it with builders, but usually only `issuer` and `jwks_uri` are necessary.

```
// Fetched issuer metadata:
$issuerMetadata = [
    'issuer' => 'https://issuer-name', // The Issuer name
    'jwks_uri' => 'https://jwks_uri', // The Issuer's JWK Set URI
];
```

The remote `jwks_uri` is the remote endpoint where the issuer public keys are exposed.

You also need the Client Metadata, usually the same provided from the [OpenID Dynamic Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata)but **you can just provide the `client_id`** and optionally the `client_secret` (in case the tokens are signed with symmetric key using the client secret).

Verfiers and decrypters are automatically configured using the [OpenID Dynamic Registration](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata)client metadata.

If you use encryption, you should inject your JWK Set in the configuration `jwks` keys.

```
// Client Metadata (complete configuration example)
$clientMetadata = [
    'client_id' => 'my-client-id',
    'client_secret' => 'my-client-secret',
    'id_token_signed_response_alg' => 'RS256',
    'id_token_encrypted_response_alg' => 'RSA-OAEP',
    'id_token_encrypted_response_enc' => 'A128GCM',
    'userinfo_signed_response_alg' => 'RS256',
    'userinfo_encrypted_response_alg' => 'RSA-OAEP',
    'userinfo_encrypted_response_enc' => 'A128GCM',
    'jwks' => [
        'keys' => [
            // client JWKs
        ],
    ],
];
```

```
use Facile\JoseVerifier\Builder\AccessTokenVerifierBuilder;
use Facile\JoseVerifier\Exception\InvalidTokenExceptionInterface;

$builder = AccessTokenVerifierBuilder::create($issuerMetadata, $clientMetadata);

$verifier = $builder->build();
try {
    $payload = $verifier->verify($jwt);
} catch (InvalidTokenExceptionInterface $e) {
    // your logic here
}
```

The verifier will decrypt and validate the token for you. The result is the token payload.

Using cache to fetch remote JWK Set
-----------------------------------

[](#using-cache-to-fetch-remote-jwk-set)

Obviously you should not fetch the remote JWK Set on every request. In order to use cache you can inject a partially configured `JwksProviderBuilder`.

```
use Facile\JoseVerifier\Builder\AccessTokenVerifierBuilder;use Facile\JoseVerifier\JWK\JwksProviderBuilder;

// Use your PSR SimpleCache implementation
$cache = $container->get(\Psr\SimpleCache\CacheInterface::class);

$jwksProviderBuilder = (new JwksProviderBuilder())
    ->withCache($cache)
    ->withCacheTtl(86400); // 86400 is the default value

$builder = AccessTokenVerifierBuilder::create($issuerMetadata, $clientMetadata)
    ->withJwksProviderBuilder($jwksProviderBuilder);

$verifier = $builder->build();
try {
    $payload = $verifier->verify($jwt);
} catch (InvalidTokenExceptionInterface $e) {
    // your logic here
}
```

Provided verifiers
------------------

[](#provided-verifiers)

### Access Token Verifier

[](#access-token-verifier)

The AccessTokenVerifier will validate a JWT access token.

```
use Facile\JoseVerifier\Builder\AccessTokenVerifierBuilder;

$builder = AccessTokenVerifierBuilder::create($issuerMetadata, $clientMetadata);

$verifier = $builder->build();
try {
    $payload = $verifier->verify($jwt);
} catch (InvalidTokenExceptionInterface $e) {
    // your logic here
}
```

### ID Token Verifier

[](#id-token-verifier)

The IdTokenVerifier will validate an OpenID `id_token`.

Create the verifier:

```
use Facile\JoseVerifier\Builder\IdTokenVerifierBuilder;

$builder = IdTokenVerifierBuilder::create($issuerMetadata, $clientMetadata);

$verifier = $builder->build();
```

In order to validate an `id_token` you must provide some other parameters to the verifier (note that all verifiers are immutable).

```
use Facile\JoseVerifier\IdTokenVerifierInterface;

/** @var IdTokenVerifierInterface $verifier */

// Provide the `state` used in the Code Grant Flow (this should be provided id the `id_token` contains the `s_hash` claim)
$verifier = $verifier->withState($state);

// Optionally provide these parameters to validate the correct hash values:

$verifier = $verifier
    ->withAccessToken($accessToken) // Provide the `access_token` used in the Code Grant Flow
    ->withCode($code) // Provide the `code` used in the Code Grant Flow

try {
    $payload = $verifier->verify($jwt);
} catch (InvalidTokenExceptionInterface $e) {
    // your logic here
}
```

### UserInfo Verifier

[](#userinfo-verifier)

When UserInfo returns a signed (and maybe encrypted) JWT as response content of the userinfo endpoint you can use this verifier to decrypt, verify, and obtain user info claims.

```
use Facile\JoseVerifier\Builder\UserInfoVerifierBuilder;

$builder = UserInfoVerifierBuilder::create($issuerMetadata, $clientMetadata);

$verifier = $builder->build();
try {
    $payload = $verifier->verify($jwt);
} catch (InvalidTokenExceptionInterface $e) {
    // your logic here
}
```

###  Health Score

64

—

FairBetter than 99% of packages

Maintenance92

Actively maintained with recent releases

Popularity45

Moderate usage in the ecosystem

Community22

Small or concentrated contributor base

Maturity80

Battle-tested with a long release history

 Bus Factor1

Top contributor holds 70.7% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~107 days

Recently: every ~193 days

Total

22

Last Release

67d ago

Major Versions

0.5.2 → 1.0.02026-06-12

PHP version history (5 changes)0.1.0PHP ^7.2

0.3.0-beta1PHP ^7.3 || ^8.0

0.3.0-beta2PHP ^7.2 || ^8.0

0.5.0-beta1PHP ^8.1

1.0.0PHP ^8.2

### Community

Maintainers

![](https://www.gravatar.com/avatar/a6fa237583695920bbe285e738810728bfd7981ab066d39ffe852e09ae1fd30e?d=identicon)[thomasvargiu](/maintainers/thomasvargiu)

---

Top Contributors

[![thomasvargiu](https://avatars.githubusercontent.com/u/732012?v=4)](https://github.com/thomasvargiu "thomasvargiu (82 commits)")[![Jean85](https://avatars.githubusercontent.com/u/6729988?v=4)](https://github.com/Jean85 "Jean85 (17 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (15 commits)")[![angelomelonas](https://avatars.githubusercontent.com/u/12830426?v=4)](https://github.com/angelomelonas "angelomelonas (1 commits)")[![MikeGomibo](https://avatars.githubusercontent.com/u/217560296?v=4)](https://github.com/MikeGomibo "MikeGomibo (1 commits)")

---

Tags

jwtJWSJWEJOSEJWKtokenoauth2validateOpenIdaccess tokenJWKSverifier

###  Code Quality

TestsPHPUnit

Static AnalysisPsalm, Rector

Code StylePHP CS Fixer

Type Coverage Yes

### Embed Badge

![Health badge](/badges/facile-it-php-jose-verifier/health.svg)

```
[![Health](https://phpackages.com/badges/facile-it-php-jose-verifier/health.svg)](https://phpackages.com/packages/facile-it-php-jose-verifier)
```

###  Alternatives

[flow-php/flow

PHP ETL - Extract Transform Load - Data processing framework

86337.5k](/packages/flow-php-flow)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

595.8M674](/packages/shopware-core)[symfony/symfony

The Symfony PHP framework

31.4k87.4M2.2k](/packages/symfony-symfony)[shopware/platform

The Shopware e-commerce core

3.4k1.5M3](/packages/shopware-platform)[tempest/framework

The PHP framework that gets out of your way.

2.3k37.6k21](/packages/tempest-framework)[sylius/sylius

E-Commerce platform for PHP, based on Symfony framework.

8.5k6.0M777](/packages/sylius-sylius)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)