JWT Authentication in Laravel: A Complete Guide

kavita.laravel311

19 June 2026

Introduction

Laravel API authentication using JWT is a secure way to protect modern web applications and APIs.

Authentication is essential in modern web apps to protect user data and APIs.

Traditional session-based authentication can be limiting for stateless systems like APIs and SPAs.

JWT (JSON Web Token) offers a secure, scalable, stateless way to authenticate users without server-side sessions.

In this guide, you’ll learn how Laravel API authentication using JWT works, explore its advantages,
and implement it step by step to build secure and efficient REST APIs.

What is JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) used for securely transmitting information between parties as a JSON object.

A JWT consists of three parts:

Header.Payload.Signature

1	Header.Payload.Signature

Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.
eyJzdWIiOiIxMjM0NTY3ODkwIn0
.
dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

eyJzdWIiOiIxMjM0NTY3ODkwIn0

dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U

JWT Components

Header

Contains token metadata and signing algorithm.

{
  "alg": "HS256",
  "typ": "JWT"
}

{

"alg": "HS256",

"typ": "JWT"

}

Payload

Contains claims and user-related information.

{
  "sub": 1,
  "email": "user@example.com"
}

{

"sub": 1,

"email": "user@example.com"

}

Signature

Used to verify the integrity of the token.

Why Use JWT Authentication?

JWT offers several advantages:

Stateless Authentication

No need to store session data on the server.

Scalability

Ideal for distributed systems and microservices.

Mobile-Friendly

Works seamlessly with Android and iOS applications.

Cross-Domain Support

Perfect for APIs consumed by multiple frontend applications.

Performance

Reduces database lookups and session management overhead.

Setting Up JWT Authentication in Laravel

Step 1: Install JWT Package

Laravel does not include JWT support by default, so install the popular package:

composer require tymon/jwt-auth

1	composer require tymon/jwt-auth

Step 2: Publish Configuration

Generate the package configuration file:

php artisan vendor:publish --provider="Tymon\JWTAuth\Providers\LaravelServiceProvider"

1	php artisan vendor:publish --provider="Tymon\JWTAuth\Providers\LaravelServiceProvider"

This creates:

config/jwt.php

1	config/jwt.php

Step 3: Generate JWT Secret Key

Generate a secret key used to sign tokens:

php artisan jwt:secret

1	php artisan jwt:secret

A new entry will be added to your .env file:

JWT_SECRET=your_generated_secret_key

1	JWT_SECRET=your_generated_secret_key

Keep this key secure and never expose it publicly.

Configure the User Model

Update the User model to implement the JWTSubject interface.

<?php

namespace App\Models;

use Tymon\JWTAuth\Contracts\JWTSubject;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable implements JWTSubject
{
    public function getJWTIdentifier()
    {
        return $this->getKey();
    }

    public function getJWTCustomClaims()
    {
        return [];
    }
}

<?php

namespace App\Models;

use Tymon\JWTAuth\Contracts\JWTSubject;

use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable implements JWTSubject

{

public function getJWTIdentifier()

{

return $this->getKey();

}

public function getJWTCustomClaims()

{

return [];

}

Configure Authentication Guard

Update config/auth.php.

'guards' => [
    'api' => [
        'driver' => 'jwt',
        'provider' => 'users',
    ],
],

'guards' => [

'api' => [

'driver' => 'jwt',

'provider' => 'users',

This tells Laravel to use JWT for API authentication.

Creating Authentication Endpoints

Create an authentication controller:

php artisan make:controller AuthController

1	php artisan make:controller AuthController

User Registration

public function register(Request $request)
{
    $validated = $request->validate([
        'name' => 'required|string|max:255',
        'email' => 'required|email|unique:users',
        'password' => 'required|min:8|confirmed'
    ]);

    $user = User::create([
        'name' => $validated['name'],
        'email' => $validated['email'],
        'password' => bcrypt($validated['password'])
    ]);

    return response()->json([
        'message' => 'User registered successfully'
    ]);
}

public function register(Request $request)

{

$validated = $request->validate([

'name' => 'required|string|max:255',

'email' => 'required|email|unique:users',

'password' => 'required|min:8|confirmed'

]);

$user = User::create([

'name' => $validated['name'],

'email' => $validated['email'],

'password' => bcrypt($validated['password'])

]);

return response()->json([

'message' => 'User registered successfully'

]);

}

User Login

public function login(Request $request)
{
    $credentials = $request->only('email', 'password');

    if (!$token = auth('api')->attempt($credentials)) {
        return response()->json([
            'message' => 'Invalid credentials'
        ], 401);
    }

    return response()->json([
        'access_token' => $token,
        'token_type' => 'Bearer',
        'expires_in' => auth('api')->factory()->getTTL() * 60
    ]);
}

public function login(Request $request)

{

$credentials = $request->only('email', 'password');

if (!$token = auth('api')->attempt($credentials)) {

return response()->json([

'message' => 'Invalid credentials'

], 401);

}

return response()->json([

'access_token' => $token,

'token_type' => 'Bearer',

'expires_in' => auth('api')->factory()->getTTL() * 60

]);

}

Get Authenticated User

public function me()
{
    return response()->json(auth('api')->user());
}

public function me()

{

return response()->json(auth('api')->user());

}

Refresh Token

public function refresh()
{
    return response()->json([
        'access_token' => auth('api')->refresh()
    ]);
}

public function refresh()

{

return response()->json([

'access_token' => auth('api')->refresh()

]);

}

Logout User

public function logout()
{
    auth('api')->logout();

    return response()->json([
        'message' => 'Successfully logged out'
    ]);
}

public function logout()

{

auth('api')->logout();

return response()->json([

'message' => 'Successfully logged out'

]);

}

Define API Routes

Add routes in routes/api.php.

use App\Http\Controllers\AuthController;

Route::prefix('auth')->group(function () {

    Route::post('/register', [AuthController::class, 'register']);
    Route::post('/login', [AuthController::class, 'login']);

    Route::middleware('auth:api')->group(function () {

        Route::get('/me', [AuthController::class, 'me']);
        Route::post('/refresh', [AuthController::class, 'refresh']);
        Route::post('/logout', [AuthController::class, 'logout']);
    });
});

use App\Http\Controllers\AuthController;

Route::prefix('auth')->group(function () {

Route::post('/register', [AuthController::class, 'register']);

Route::post('/login', [AuthController::class, 'login']);

Route::middleware('auth:api')->group(function () {

Route::get('/me', [AuthController::class, 'me']);

Route::post('/refresh', [AuthController::class, 'refresh']);

Route::post('/logout', [AuthController::class, 'logout']);

});

Protecting Routes

Any route can be protected using Laravel middleware.

Route::middleware('auth:api')->group(function () {

    Route::get('/profile', function () {
        return auth()->user();
    });

});

Route::middleware('auth:api')->group(function () {

Route::get('/profile', function () {

return auth()->user();

});

Requests without a valid JWT token will receive a 401 Unauthorized response.

Sending JWT Token from Frontend

After login, store the token securely.

JavaScript Fetch Example

const response = await fetch('/api/auth/login', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({
        email: 'user@example.com',
        password: 'password'
    })
});

const data = await response.json();

localStorage.setItem('token', data.access_token);

const response = await fetch('/api/auth/login', {

method: 'POST',

headers: {

'Content-Type': 'application/json'

body: JSON.stringify({

email: 'user@example.com',

password: 'password'

})

});

const data = await response.json();

localStorage.setItem('token', data.access_token);

Authenticated Request

fetch('/api/auth/me', {
    headers: {
        Authorization: `Bearer ${localStorage.getItem('token')}`
    }
});

fetch('/api/auth/me', {

headers: {

Authorization: `Bearer ${localStorage.getItem('token')}`

}

});

Security Best Practices

1. Always Use HTTPS

JWT tokens should never be transmitted over unsecured HTTP connections.

2. Keep Token Expiry Short

Configure token lifetime in:

config/jwt.php

1	config/jwt.php

Example:

'ttl' => 60

1	'ttl' => 60

This expires tokens after 60 minutes.

3. Implement Token Refresh

Short-lived access tokens combined with refresh tokens improve security significantly.

4. Avoid Storing Sensitive Data

Never store passwords, personal information, or confidential business data inside JWT payloads.

5. Use Role-Based Claims

You can include user roles directly inside JWT claims.

public function getJWTCustomClaims()
{
    return [
        'role' => $this->role
    ];
}

public function getJWTCustomClaims()

{

return [

'role' => $this->role

];

}

This helps build authorization systems efficiently.

Common JWT Errors and Fixes

Token Expired

Error

TokenExpiredException

1	TokenExpiredException

Solution

Use the refresh endpoint to generate a new access token.

Token Not Provided

Error

Token not provided

1	Token not provided

Solution

Ensure the request contains:

Authorization: Bearer YOUR_TOKEN

1	Authorization: Bearer YOUR_TOKEN

Invalid Credentials

Error

Unauthorized

1	Unauthorized

Solution

Verify the email and password before generating the token.

Testing JWT Authentication

Example Laravel feature test:

public function test_user_can_login()
{
    $user = User::factory()->create([
        'password' => bcrypt('password123')
    ]);

    $response = $this->postJson('/api/auth/login', [
        'email' => $user->email,
        'password' => 'password123'
    ]);

    $response->assertStatus(200);
}

public function test_user_can_login()

{

$user = User::factory()->create([

'password' => bcrypt('password123')

]);

$response = $this->postJson('/api/auth/login', [

'email' => $user->email,

'password' => 'password123'

]);

$response->assertStatus(200);

}

Testing ensures authentication continues to work correctly as your application evolves.

Conclusion

JWT authentication works well in Laravel APIs for web, mobile, and third-party clients.

It is stateless, scalable, and fits modern API-based architectures.

With token expiration, refresh tokens, HTTPS, and role-based access, you can build a secure and maintainable system.

If you’re building a Laravel REST API, mastering JWT authentication is an essential skill that will help you create secure, production-ready applications.

Also you can hire laravel developers to customize this feature for your business needs.
Kindly explore our extensions.