PHP JWT Generator

PHP JWT generator quickstart

Create a token with your public API key in the sub claim, a near-term Unix timestamp in exp, and an HS256 signature made with your private API key.

Sapling JWTs use HS256 with a sub claim containing your public API key and an exp claim containing a Unix timestamp. The examples use a one-hour lifetime; shorten it further when your application can refresh tokens easily.

PHP HS256 · sub + exp

This example uses firebase/php-jwt.

<?php

require 'vendor/autoload.php';

use Firebase\JWT\JWT;

$publicKey = getenv('SAPLING_PUBLIC_KEY');
$privateKey = getenv('SAPLING_PRIVATE_KEY');
if (!$publicKey || !$privateKey) {
    throw new RuntimeException(
        'Set SAPLING_PUBLIC_KEY and SAPLING_PRIVATE_KEY first.'
    );
}

$token = JWT::encode([
    'sub' => $publicKey,
    'exp' => time() + 3600,
], $privateKey, 'HS256');

echo $token;

Generated token text/plain

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.<base64url-claims>.<signature>

Return the compact token to the browser and pass it to Sapling.init as the key. Issue a fresh token after it expires; never send the private key.

Reference Frontend key management and JWT documentation All languages Choose another quickstart

About PHP

PHP is a popular scripting language for the web. It is typically processed on a web server as a module, daemon or CGI executable. Many popular web services are written in PHP including well-known websites such as Facebook and frameworks like Wordpress.