Nexus API Reference

JwtAuthenticator
in package
implements Authenticator

Read onlyYes
FinalYes
Tags
psalm-api

Verifies a JWT (HS256/RS256/ES256/EdDSA per the configured signer) and delegates Principal construction to the claims-mapper closure.

$jwt = Configuration::forSymmetricSigner(new Sha256(), InMemory::plainText($secret)); $auth = new JwtAuthenticator( $jwt, new BearerTokenExtractor(), fn (Plain $t) => new SimplePrincipal( id: (string) $t->claims()->get('sub'), scopes: explode(' ', (string) $t->claims()->get('scope', '')), ), );

Failures (bad signature, expired, malformed) return null — never throw. The reason is logged via PSR-3 at info/debug, never disclosed on the wire.

Table of Contents

Interfaces

Authenticator

Methods

__construct()  : mixed
authenticate()  : Principal|null

Methods

__construct()

public __construct(Configuration $jwt[, TokenExtractor|null $extractor = null ][, callable(Plain): Array $claimsMapper = null ][, LoggerInterface|null $logger = null ][, ClockInterface|null $clock = null ][, array<int, non-empty-string> $issuers = [] ][, non-empty-string|null $audience = null ][, non-empty-string|null $subject = null ][, DateInterval|null $leeway = null ]) : mixed
Parameters
$jwt : Configuration
$extractor : TokenExtractor|null = null
$claimsMapper : callable(Plain): Array = null
$logger : LoggerInterface|null = null
$clock : ClockInterface|null = null
$issuers : array<int, non-empty-string> = []

Accept only tokens whose iss is one of these (any-of). Empty = do not constrain the issuer.

$audience : non-empty-string|null = null

Require the token's aud to contain this.

$subject : non-empty-string|null = null

Require the token's sub to equal this.

$leeway : DateInterval|null = null

Clock-skew tolerance for time claims. When set, time validity is checked loosely within the leeway; otherwise strictly (no skew allowed).

authenticate()

public authenticate(ServerRequestInterface $request) : Principal|null
Parameters
$request : ServerRequestInterface
Attributes
#[Override]
Return values
Principal|null
On this page

Search results