// the find
tymondesigns/jwt-auth
🔐 JSON Web Token Authentication for Laravel & Lumen
JWT authentication package for Laravel and Lumen — drops in as a guard, parses tokens from headers/cookies/query strings, and handles blacklisting via cache. It's been the de facto JWT solution for Laravel for nearly a decade and covers the full token lifecycle. If you're building a stateless API with Laravel and need JWT without rolling your own, this is still what most people reach for.
The blacklist implementation is well thought out — tokens go into whatever cache driver you're already using, so you're not adding a dependency just to invalidate tokens. The provider abstraction (JWT provider, auth provider, storage provider) means you can swap out the underlying JWT library if lcobucci/jwt ever becomes a problem. Parser chain (headers, cookies, query string, route params) covers every realistic client scenario without configuration gymnastics. Test coverage is solid — claims, middleware, guard, manager, and parsers all have dedicated test classes.
The README is basically empty — three lines pointing at an external docs site, and that site has been flaky for years. If jwt-auth.com goes down, new adopters are stuck reading the source. Token refresh semantics are slippery: the RefreshToken middleware will rotate a token that's past expiry but within the refresh TTL, which sounds fine until you realize concurrent requests during that window will race and one will invalidate the other. The package is tied to lcobucci/jwt 4.x under the hood; if you need JWKS or RS256 key rotation from a real identity provider (Auth0, Cognito), you're going to fight the abstraction. And with Laravel Sanctum now shipping in the box for API tokens, the maintenance pressure on this package is real — the last meaningful commit activity has slowed noticeably.