Implementing secure authentication in REST APIs is a must for modern applications. One of the most widely used methods is JWT (JSON Web Token), which allows stateless, scalable authentication without storing sessions on the server.<\/p>\n
In this tutorial, you\u2019ll learn how to build a complete REST API with JWT Authentication using Core PHP (without any framework). We\u2019ll cover:<\/p>\n
JWT (JSON Web Token) is a compact, URL-safe token used to secure API endpoints.
\nAfter the user logs in, the server returns a signed JWT token, and the client must send this token in every request.<\/p>\n
A JWT contains three parts:<\/p>\n
Example:<\/p>\n
xxxxx.yyyyy.zzzzz<\/pre>\n\ud83d\udc49 Using JWT avoids storing sessions, making the API fully stateless and scalable.<\/p>\n
\ud83d\ude80 Let’s get started building the Complete REST API with JWT Authentication in PHP!<\/b><\/p>\n
\ud83d\udcc1 Folder Structure<\/h2>\n
Before getting started to build a Complete PHP REST API with MySQL, PDO, JWT Authentication, take a look at the file structure for this project:<\/p>\n
rest_api_with_jwt_authentication_in_php\/\r\n\u251c\u2500\u2500 api\/\r\n\u2502 \u251c\u2500\u2500 _init.php\r\n\u2502 \u251c\u2500\u2500 login.php\r\n\u2502 \u251c\u2500\u2500 register.php\r\n\u2502 \u251c\u2500\u2500 user.php\r\n\u2502 \u251c\u2500\u2500 update.php\r\n\u2502 \u251c\u2500\u2500 change_password.php\r\n\u2502 \u2514\u2500\u2500 logout.php\r\n\u2502\r\n\u251c\u2500\u2500 config.php\r\n\u251c\u2500\u2500 db.php\r\n\u251c\u2500\u2500 jwt.php\r\n\u251c\u2500\u2500 user.php\r\n\u2514\u2500\u2500 blacklist.php\r\n<\/pre>\nStep 1: Create Database and Tables<\/h2>\n
Create a MySQL database (e.g.,
rest_api_jwt<\/code>) and then run the following SQL to create the necessary tables:users<\/code> andjwt_blacklist<\/code>.<\/p>\nCREATE<\/span> TABLE<\/span> `users`<\/span> (\r\n `id`<\/span> INT<\/span> UNSIGNED<\/span> NOT<\/span> NULL<\/span> AUTO_INCREMENT,\r\n `name`<\/span> VARCHAR<\/span>(191<\/span>) NOT<\/span> NULL<\/span>,\r\n `email`<\/span> VARCHAR<\/span>(191<\/span>) NOT<\/span> NULL<\/span> UNIQUE<\/span>,\r\n `password_hash`<\/span> VARCHAR<\/span>(255<\/span>) NOT<\/span> NULL<\/span>,\r\n `created_at`<\/span> DATETIME NOT<\/span> NULL<\/span>,\r\n `updated_at`<\/span> DATETIME NOT<\/span> NULL<\/span>,\r\n PRIMARY KEY<\/span> (`id`<\/span>)\r\n) ENGINE<\/span>=InnoDB<\/span> DEFAULT<\/span> CHARSET<\/span>=utf8mb4;\r\n\r\nCREATE<\/span> TABLE<\/span> `jwt_blacklist`<\/span> (\r\n `id`<\/span> INT<\/span> UNSIGNED<\/span> NOT<\/span> NULL<\/span> AUTO_INCREMENT,\r\n `jti`<\/span> VARCHAR<\/span>(64<\/span>) NOT<\/span> NULL<\/span>,\r\n `expires_at`<\/span> DATETIME NOT<\/span> NULL<\/span>,\r\n `created_at`<\/span> DATETIME NOT<\/span> NULL<\/span>,\r\n PRIMARY KEY<\/span> (`id`<\/span>),\r\n INDEX<\/span> (`jti`<\/span>)\r\n) ENGINE<\/span>=InnoDB<\/span> DEFAULT<\/span> CHARSET<\/span>=utf8mb4;<\/pre>\nStep 2: Database and JWT Configuration<\/h2>\n
Create a
config.php<\/code> file in the root directory to store database and JWT configuration settings.<\/p>\n<?php
<\/span>\/\/ Database configuration
<\/span>define<\/span>(<\/span>'DB_HOST'<\/span>, <\/span>'localhost'<\/span>);
<\/span>define<\/span>(<\/span>'DB_NAME'<\/span>, <\/span>'rest_api_jwt'<\/span>);
<\/span>define<\/span>(<\/span>'DB_USER'<\/span>, <\/span>'root'<\/span>);
<\/span>define<\/span>(<\/span>'DB_PASS'<\/span>, <\/span>'root_pass'<\/span>);
<\/span>\/\/ JWT secret - change to a long random string in production
<\/span>define<\/span>(<\/span>'JWT_SECRET'<\/span>, <\/span>'replace_this_with_a_long_random_secret'<\/span>);
<\/span>\/\/ Token lifetime in seconds
<\/span>define<\/span>(<\/span>'JWT_TTL'<\/span>, <\/span>3600<\/span>);
<\/span>\/\/ Optional issuer\/audience
<\/span>define<\/span>(<\/span>'JWT_ISS'<\/span>, <\/span>'my-php-api'<\/span>);
<\/span>define<\/span>(<\/span>'JWT_AUD'<\/span>, <\/span>'my-php-api-users'<\/span>);
<\/span>\/\/ Set default timezone
<\/span>date_default_timezone_set<\/span>(<\/span>'UTC'<\/span>);
<\/span>?><\/span><\/pre>\nStep 3: Database Connection<\/h2>\n
Create a
db.php<\/code> file to handle the database connection using PDO.<\/p>\n<?php
<\/span>require_once <\/span>__DIR__ <\/span>. <\/span>'\/config.php'<\/span>;
class <\/span>Database <\/span>{
private static <\/span>$pdo <\/span>= <\/span>null<\/span>;
public static function <\/span>getConnection<\/span>() {
if (<\/span>self<\/span>::<\/span>$pdo <\/span>=== <\/span>null<\/span>) {
<\/span>$dsn <\/span>= <\/span>\"mysql:host=\" <\/span>. <\/span>DB_HOST <\/span>. <\/span>\";dbname=\" <\/span>. <\/span>DB_NAME <\/span>. <\/span>\";charset=utf8mb4\"<\/span>;
<\/span>$options <\/span>= [
<\/span>PDO<\/span>::<\/span>ATTR_ERRMODE <\/span>=> <\/span>PDO<\/span>::<\/span>ERRMODE_EXCEPTION<\/span>,
<\/span>PDO<\/span>::<\/span>ATTR_DEFAULT_FETCH_MODE <\/span>=> <\/span>PDO<\/span>::<\/span>FETCH_ASSOC<\/span>,
<\/span>PDO<\/span>::<\/span>ATTR_EMULATE_PREPARES <\/span>=> <\/span>false<\/span>,
];
try {
<\/span>self<\/span>::<\/span>$pdo <\/span>= new <\/span>PDO<\/span>(<\/span>$dsn<\/span>, <\/span>DB_USER<\/span>, <\/span>DB_PASS<\/span>, <\/span>$options<\/span>);
} catch (<\/span>PDOException $e<\/span>) {
<\/span>http_response_code<\/span>(<\/span>500<\/span>);
echo <\/span>json_encode<\/span>([<\/span>\"error\" <\/span>=> <\/span>\"Database connection failed: \" <\/span>. <\/span>$e<\/span>-><\/span>getMessage<\/span>()]);
exit;
}
}
return <\/span>self<\/span>::<\/span>$pdo<\/span>;
}
}
<\/span>?><\/span><\/pre>\nStep 4: JWT Helper Functions<\/h2>\n
Create a
jwt.php<\/code> file to handle JWT creation and verification using PHP.<\/p>\nWe will use PHP\u2019s OpenSSL to generate and verify JWT tokens:<\/p>\n
\n
- Function to base64UrlEncode data<\/li>\n
- Function to base64UrlDecode data<\/li>\n
- Function to encode JWT token<\/li>\n
- Function to decode JWT token<\/li>\n
- Function to generate JWT token for user authentication<\/li>\n<\/ul>\n
<?php
<\/span>require_once <\/span>__DIR__ <\/span>. <\/span>'\/config.php'<\/span>;
function <\/span>base64url_encode<\/span>(<\/span>$data<\/span>) {
return <\/span>rtrim<\/span>(<\/span>strtr<\/span>(<\/span>base64_encode<\/span>