JWT Code Examples

<?php
require 'vendor/autoload.php';
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

// Secret key (store in environment variables)
$secret_key = getenv("JWT_SECRET"); // 32+ random bytes, e.g. openssl rand -base64 32
$issuer = "https://yourdomain.com";
$audience = "https://yourdomain.com";

// Create token payload
$payload = [
    "iss" => $issuer,           // Issuer
    "aud" => $audience,         // Audience
    "iat" => time(),            // Issued at
    "nbf" => time(),            // Not before
    "exp" => time() + 3600,     // Expiration (1 hour)
    "data" => [
        "user_id" => 123,
        "username" => "john_doe",
        "role" => "admin"
    ]
];

// Generate JWT
$jwt = JWT::encode($payload, $secret_key, 'HS256');
echo $jwt;
// Output: "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3lvdXJkb21haW4uY29tIiwiYXVkIjoiaHR0cHM6Ly95b3VyZG9tYWluLmNvbSIsImlhdCI6MTY4MDAwMDAwMCwibmJmIjoxNjgwMDAwMDAwLCJleHAiOjE2ODAwMDM2MDAsImRhdGEiOnsidXNlcl9pZCI6MTIzLCJ1c2VybmFtZSI6ImpvaG5fZG9lIiwicm9sZSI6ImFkbWluIn19.signature"

// Decode and verify JWT
try {
    $decoded = JWT::decode($jwt, new Key($secret_key, 'HS256'));
    print_r($decoded->data);
} catch (Exception $e) {
    echo "Invalid token: " . $e->getMessage();
}

const jwt = require('jsonwebtoken');

// Secret key (store in environment variables)
const SECRET_KEY = process.env.JWT_SECRET; // 32+ random bytes; never fall back to a literal
if (!SECRET_KEY) throw new Error('JWT_SECRET is not set');
const ISSUER = 'https://yourdomain.com';
const AUDIENCE = 'https://yourdomain.com';

// Create token payload
const payload = {
    user_id: 123,
    username: 'john_doe',
    role: 'admin'
};

// Generate JWT with options
const token = jwt.sign(payload, SECRET_KEY, {
    algorithm: 'HS256',
    expiresIn: '1h',        // 1 hour
    issuer: ISSUER,
    audience: AUDIENCE
});

console.log(token);
// Output: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjMsInVzZXJuYW1lIjoiam9obl9kb2UiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE2ODAwMDAwMDAsImV4cCI6MTY4MDAwMzYwMCwiaXNzIjoiaHR0cHM6Ly95b3VyZG9tYWluLmNvbSIsImF1ZCI6Imh0dHBzOi8veW91cmRvbWFpbi5jb20ifQ.signature"

// Verify and decode JWT
try {
    const decoded = jwt.verify(token, SECRET_KEY, {
        algorithms: ['HS256'],
        issuer: ISSUER,
        audience: AUDIENCE
    });
    console.log(decoded);
} catch (err) {
    console.error('Invalid token:', err.message);
}

// Express.js middleware example
const authenticateJWT = (req, res, next) => {
    const token = req.headers.authorization?.split(' ')[1]; // Bearer token

    if (!token) {
        return res.sendStatus(401);
    }

    jwt.verify(token, SECRET_KEY, { algorithms: ['HS256'], issuer: ISSUER, audience: AUDIENCE }, (err, user) => {
        if (err) return res.sendStatus(403);
        req.user = user;
        next();
    });
};

import jwt
import datetime
import os

# Secret key (store in environment variables)
SECRET_KEY = os.environ['JWT_SECRET']  # 32+ random bytes, e.g. secrets.token_urlsafe(32)
ISSUER = 'https://yourdomain.com'
AUDIENCE = 'https://yourdomain.com'
ALGORITHM = 'HS256'

# Create token payload
payload = {
    'user_id': 123,
    'username': 'john_doe',
    'role': 'admin',
    'iss': ISSUER,
    'aud': AUDIENCE,
    'iat': datetime.datetime.now(datetime.timezone.utc),
    'exp': datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(hours=1)
}

# Generate JWT
token = jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)
print(token)
# Output: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

# Decode and verify JWT
try:
    decoded = jwt.decode(
        token,
        SECRET_KEY,
        algorithms=[ALGORITHM],
        issuer=ISSUER,
        audience=AUDIENCE
    )
    print(decoded)
except jwt.ExpiredSignatureError:
    print("Token has expired")
except jwt.InvalidTokenError as e:
    print(f"Invalid token: {e}")

# Flask decorator example
from functools import wraps
from flask import request, jsonify

def token_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        token = request.headers.get('Authorization')
        if not token:
            return jsonify({'message': 'Token is missing'}), 401

        try:
            token = token.split(' ')[1]  # Remove "Bearer "
            data = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM], issuer=ISSUER, audience=AUDIENCE)
        except (IndexError, jwt.InvalidTokenError):
            return jsonify({'message': 'Invalid token'}), 403

        return f(*args, **kwargs)
    return decorated

import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import java.security.Key;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;

public class JwtGenerator {
    // Secret key (256 bits for HS256)
    private static final String SECRET = "your-256-bit-secret-key-minimum-32-characters";
    private static final Key KEY = Keys.hmacShaKeyFor(SECRET.getBytes());
    private static final String ISSUER = "https://yourdomain.com";
    private static final String AUDIENCE = "https://yourdomain.com";

    public static String generateToken(String userId, String username, String role) {
        long nowMillis = System.currentTimeMillis();
        Date now = new Date(nowMillis);
        Date exp = new Date(nowMillis + 3600000); // 1 hour

        // Custom claims
        Map<String, Object> claims = new HashMap<>();
        claims.put("user_id", userId);
        claims.put("username", username);
        claims.put("role", role);

        return Jwts.builder()
                .setClaims(claims)
                .setIssuer(ISSUER)
                .setAudience(AUDIENCE)
                .setIssuedAt(now)
                .setExpiration(exp)
                .signWith(KEY, SignatureAlgorithm.HS256)
                .compact();
    }

    public static Claims validateToken(String token) {
        try {
            return Jwts.parserBuilder()
                    .setSigningKey(KEY)
                    .requireIssuer(ISSUER)
                    .requireAudience(AUDIENCE)
                    .build()
                    .parseClaimsJws(token)
                    .getBody();
        } catch (JwtException e) {
            throw new RuntimeException("Invalid JWT token: " + e.getMessage());
        }
    }

    public static void main(String[] args) {
        String token = generateToken("123", "john_doe", "admin");
        System.out.println("JWT: " + token);

        Claims claims = validateToken(token);
        System.out.println("User ID: " + claims.get("user_id"));
    }
}

using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

public class JwtGenerator
{
    private const string SecretKey = "your-256-bit-secret-key-minimum-32-characters";
    private const string Issuer = "https://yourdomain.com";
    private const string Audience = "https://yourdomain.com";

    public static string GenerateToken(string userId, string username, string role)
    {
        var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey));
        var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

        var claims = new[]
        {
            new Claim("user_id", userId),
            new Claim("username", username),
            new Claim("role", role),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
        };

        var token = new JwtSecurityToken(
            issuer: Issuer,
            audience: Audience,
            claims: claims,
            expires: DateTime.UtcNow.AddHours(1),
            signingCredentials: credentials
        );

        return new JwtSecurityTokenHandler().WriteToken(token);
    }

    public static ClaimsPrincipal ValidateToken(string token)
    {
        var tokenHandler = new JwtSecurityTokenHandler();
        var key = Encoding.UTF8.GetBytes(SecretKey);

        var validationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = Issuer,
            ValidAudience = Audience,
            IssuerSigningKey = new SymmetricSecurityKey(key)
        };

        return tokenHandler.ValidateToken(token, validationParameters, out _);
    }

    public static void Main()
    {
        string jwt = GenerateToken("123", "john_doe", "admin");
        Console.WriteLine($"JWT: {jwt}");

        var principal = ValidateToken(jwt);
        Console.WriteLine($"User: {principal.FindFirst("username")?.Value}");
    }
}

#include <jwt-cpp/jwt.h>
#include <iostream>
#include <chrono>
#include <cstdlib>
#include <stdexcept>

std::string generateJWT(const std::string& userId,
                        const std::string& username,
                        const std::string& role) {
    auto now = std::chrono::system_clock::now();
    auto exp = now + std::chrono::hours(1);

    const char* env = std::getenv("JWT_SECRET"); // 32+ random bytes
    if (!env) throw std::runtime_error("JWT_SECRET is not set");
    std::string secret = env;

    auto token = jwt::create()
        .set_issuer("https://yourdomain.com")
        .set_audience("https://yourdomain.com")
        .set_issued_at(now)
        .set_expires_at(exp)
        .set_payload_claim("user_id", jwt::claim(userId))
        .set_payload_claim("username", jwt::claim(username))
        .set_payload_claim("role", jwt::claim(role))
        .sign(jwt::algorithm::hs256{secret});

    return token;
}

bool validateJWT(const std::string& token, const std::string& secret) {
    try {
        auto verifier = jwt::verify()
            .allow_algorithm(jwt::algorithm::hs256{secret})
            .with_issuer("https://yourdomain.com")
            .with_audience("https://yourdomain.com");

        auto decoded = jwt::decode(token);
        verifier.verify(decoded);

        // Access claims
        std::cout << "User ID: "
                  << decoded.get_payload_claim("user_id").as_string()
                  << std::endl;
        return true;
    } catch (const std::exception& e) {
        std::cerr << "Validation failed: " << e.what() << std::endl;
        return false;
    }
}

int main() {
    std::string jwt = generateJWT("123", "john_doe", "admin");
    std::cout << "JWT: " << jwt << std::endl;

    validateJWT(jwt, std::getenv("JWT_SECRET"));

    return 0;
}

require 'jwt'

# Secret key (store in environment variables)
SECRET_KEY = ENV.fetch('JWT_SECRET') # 32+ random bytes, e.g. SecureRandom.hex(32)
ISSUER = 'https://yourdomain.com'
AUDIENCE = 'https://yourdomain.com'
ALGORITHM = 'HS256'

def generate_jwt(user_id:, username:, role:)
  payload = {
    user_id: user_id,
    username: username,
    role: role,
    iss: ISSUER,
    aud: AUDIENCE,
    iat: Time.now.to_i,
    exp: Time.now.to_i + 3600  # 1 hour
  }

  JWT.encode(payload, SECRET_KEY, ALGORITHM)
end

def validate_jwt(token)
  begin
    decoded = JWT.decode(
      token,
      SECRET_KEY,
      true,
      {
        algorithm: ALGORITHM,
        iss: ISSUER,
        aud: AUDIENCE,
        verify_iss: true,
        verify_aud: true,
        verify_exp: true
      }
    )
    decoded.first
  rescue JWT::ExpiredSignature
    puts "Token has expired"
    nil
  rescue JWT::DecodeError => e
    puts "Invalid token: #{e.message}"
    nil
  end
end

# Generate token
jwt = generate_jwt(user_id: 123, username: 'john_doe', role: 'admin')
puts jwt
# Output: "eyJhbGciOiJIUzI1NiJ9..."

# Validate token
payload = validate_jwt(jwt)
puts payload['username'] if payload

# Rails middleware example
class JwtAuthenticator
  def self.call(request)
    token = request.headers['Authorization']&.split(' ')&.last
    return nil unless token

    validate_jwt(token)
  end
end

package main

import (
    "fmt"
    "os"
    "time"

    "github.com/golang-jwt/jwt/v5"
)

var secretKey = []byte(os.Getenv("JWT_SECRET")) // 32+ random bytes

type Claims struct {
    UserID   int    `json:"user_id"`
    Username string `json:"username"`
    Role     string `json:"role"`
    jwt.RegisteredClaims
}

func GenerateJWT(userID int, username, role string) (string, error) {
    claims := Claims{
        UserID:   userID,
        Username: username,
        Role:     role,
        RegisteredClaims: jwt.RegisteredClaims{
            Issuer:    "https://yourdomain.com",
            Audience:  jwt.ClaimStrings{"https://yourdomain.com"},
            ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
            IssuedAt:  jwt.NewNumericDate(time.Now()),
        },
    }

    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
    return token.SignedString(secretKey)
}

func ValidateJWT(tokenString string) (*Claims, error) {
    token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
        // Validate signing method
        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
        }
        return secretKey, nil
    })

    if err != nil {
        return nil, err
    }

    if claims, ok := token.Claims.(*Claims); ok && token.Valid {
        return claims, nil
    }

    return nil, fmt.Errorf("invalid token")
}

func main() {
    // Generate JWT
    token, err := GenerateJWT(123, "john_doe", "admin")
    if err != nil {
        panic(err)
    }
    fmt.Println("JWT:", token)

    // Validate JWT
    claims, err := ValidateJWT(token)
    if err != nil {
        panic(err)
    }
    fmt.Printf("User: %s (ID: %d)\n", claims.Username, claims.UserID)
}