Securing a Laravel API in 20 minutes with JWTs 

UPDATE FOR LARAVEL 6.0+: I've seen a few comments about the above video not working in Laravel 6. There was a discussion and back-and-forth on the GitHub repo about this, and there seems to be a stable solution out there now. Run "composer require tymon/jwt-auth ^1.0.0" from your project root or update your composer file directly to reflect using version ^1.0.0 of tymon/jwt-auth.

Finally somebody that speaks English.

Thank you, finally someone have explained the jwt process in a way that a beginner can understand

That is so much easier and quicker than trying to setup passport. Great video.

Finally something other than passport. You're a hero 🙏🙏🙏

Thank you very much for your video @Andrew.

this is i needed the most, need to make default guard web, but need API auth thanks !

Can you please explain the process of when how do we use the refresh token? for example if I have a react native app that consumes the API then after the login, I am going to use the token that I got in first login and won't know if it is expired or no. Do I have to always check if token is expired so that I call the refresh() method or am I missing something?

Thank you @Andrew, this is really helpful for new learners like me..

If the token refresh, will it reset the expiration time?

9:48 How are you able to use the login route without declaring it in the routes/api.php file? I had to create one myself for the login to work Route::post('/login', 'Api\Auth\LoginController@login'); Edit: Okay, I can see the route at 11:28. Declaration must have been edited out by accident lol

This is a great video! Thanks for creating it :)

Great resource, thank you for this great explanation and example of JWT tokens.

Very complicated indeed... hopefully some day I will be able to do this shit!

Just I out curiosity, I want to know why you didn't put the whole code, inside try, while creating post? I use to put whole things inside try and the catch if there any error. Any specific reason for that??

Thx, Very helpful tutorial, and it's working on Laravel 8

I am not getting it Please can you provide the soruce code cause i can see dumplecated auth folder i am its just confusing

Great jwt example thanks man...

Thank You Very Much Bro !! :D But, one thing.. I successfully created a token in one of the applications in cloud hosting. But, another app that is in the same cloud hosting returns true for JWT instead of a token. How can I Fix this ??

can we use this package for authentication of our private channels for Laravel websockets

Hi, I do have a few questions, if you dont mind. At 7:30 when you just create a new login controller inside the api/auth folder, it creates a very basic scaffolded controller, so when you start building the login function, it has nothing else than the scaffolded lines. What I had before watching this video, was a copy-pasted login controller generated from the artisan make::auth and tried to customize it. But it requieres to user the `use AuthenticatesUsers;` at the very first line of the class, so I followed the rest of the tutorial and everything works just fine, But if I remove this line "use AuthenticatesUsers;" it stops working, even when on the video, you are not using this. Secondly, when you just copied the Controller.php inside the /api folder at 9:06, you forgot to fix the namespace, so Im wondering how is that it works. But bro, so many thanks. This just helped me a LOT!!

Those who are facing this issue after moving the controller to /Api FatalErrorException: Class App\Http\Controllers\Api\Controller; not found in file change the name space above Controller.php namespace App\Http\Controllers; ------> namespace App\Http\Controllers\Api;

How can I make sure the token is device specific - I just don't want user to use the token generated on website to use inside postman request? Also, I want user to have only one active token at one time, so if he tries to login on new device then I want old token to be revoked, how can we do this? Please explain this as well. Thanks in Advance

I got one question with this method of copying the main controller. How does this respond to core updates?

Does refreshing the token invalidates all other tokens that the user may have generated?

Hi, How I can use jwt for another model except user? Like auth guard ?

how to use jwts with mongodb in laravel10 ?

thank you for this tutorial, just I want to point out that the try/catch for the authentication user is a best use case to use Laravel middleware instead of putting it within a method in the controller

Awesome tutorial. Subscribed👍

Thanks! This really helped.

can anyone tell me how auth()->attempt($creds) generated token?

How would I go about adding custom claims to the jwt such as roles, etc?

Awesome, thank you.

tymon/jwt-auth is not compatible with php8. Can you advice any other jwt package?

Works perfectly with laravel 8.* .. thanks sir

you the best bro thx

Nice Job!!! It was very helpfull!!!

this is a great tutorial, but can you tell me why it was return token: true if we did not setdefaultdriver to api thanks in advance

Hello Andrew , I love your tutorials. Please make a video for protecting the routes in vue-router. Thank you!

Hi Andrew, can you explain in short in plain english how would an external app consume that api.... it sends the credentials on login and in response it gets the token.... and then what? For example if this would be done with guzzle... you need to somehow have that token in all consecutive requests.... and that's the part that I'm missing/don't understand.

how to change the content-type of request form-data in application/json?

how to implement with change/update password checking old password ?

I'm quite new to the Laravel scene. Would this also work for Lumen?

Hi, great vid! How would you persist the JWT on the client? Let's say decoupled VUE.js app. I am looking to achieve high level of security.

Hi, Your approach to create the new controller and set the default driver for auth work like a charm for me. But can you let me know why we cannot use something like middleware('auth:api') in the group routes at the api.php? (actually I tried and fail since auth()->attempts() just return boolean instead of token key ). Moreover, Is there anyway to know which is the current default driver???

This code from this video tutorial is not working well.

Thank you very much for your efforts. I have a question please. When using this way of authentication without sending client_id and client_secret to get the access token, Does this mean that any application on the internet can use my API ? If yes, is it safe? Thank you!

Hi, Andrew nice tutorial about jwt token. I've implemented it successfully. Thanks I'll like your vscode theme and vscode font, color-code. Will u pls share these settings of vscode?? Thanks in advance...

How to do it without database. Like just an cahche

Thank you sir 👍

Can you help me why hit this type of error "Interface 'Tymon\\JWTAuth\\Contracts\\JWTSubject' not found"

Great, you applied it. How about making a vid where you apply on the laravel routes?

Just a heads up: if you put that try-catch in the parent class function and it throws an the UserNotDefinedException, the "return $user->posts" statement in the PostsController will throw another exception, because it expects $user to be an instance of App\User, but the authUser() method will return a JsonResponse with an error message. The refresh method try-catch needs to catch \Tymon\JWTAuth\Exceptions\JWTException too. It will be thrown if you try to /refresh without using any token.

JWT works without auth?

Thanks

but how to refresh when its expire?

Thanks for tutorial) PS I think it better to make middleware, not try ... catch in every method %)

Can someone share the link to the GitHub repo PLEASE.

Genius.

thanks a lot

So where are you gonna keep this token on fronted?

I would love to see this updated for 6.x Laravel.

Getting token:false My credentials are fine...

How to logout the user ??

Bro we don't need to hear your keyboard.

thanks