How to verify an ES256 JWT in PHP

1composer require firebase/php-jwt:7.2.1
2 

1<?php
2require __DIR__ . '/vendor/autoload.php';
3 
4use Firebase\JWT\JWT;
5use Firebase\JWT\Key;
6 
7JWT::$leeway = 30; // seconds of clock skew allowed for exp, nbf and iat (default 0)
8 
9// The Key binds the PEM to ES256: a token whose header says anything else is rejected
10$key = new Key(file_get_contents('pub.pem'), 'ES256');
11$claims = JWT::decode(trim(file_get_contents('token.txt')), $key); // signature, exp, nbf, iat
12 
13// php-jwt does not check iss or aud: that is the caller's job
14if (($claims->iss ?? null) !== 'https://ecdsa.com') {
15    throw new UnexpectedValueException('unexpected issuer');
16}
17echo "valid ES256 token for {$claims->sub}, expires ", gmdate('c', $claims->exp), "\n";
18 

How it works

1. new Key($pem, 'ES256') binds the public key to one algorithm. A token whose header names another algorithm fails with UnexpectedValueException: Incorrect key for this algorithm before the signature is checked.
2. JWT::decode splits the token, verifies the signature over the header.payload text (re-encoding the 64-byte r‖s as DER for openssl_verify) and returns the payload as a stdClass.
3. It throws SignatureInvalidException for a bad signature, ExpiredException after exp, and BeforeValidException before nbf (or a future iat); the run triggers the first three cases.
4. JWT::$leeway is a static setting for clock skew, 0 by default; set it once at bootstrap rather than per call.

Gotchas

• php-jwt never looks at iss or aud. Compare them yourself after decode, as the snippet does for the issuer — otherwise a valid token from another issuer that shares the key, or meant for another API, is accepted.
• A token without exp passes: the library checks expiry only when the claim exists. Require exp explicitly if your tokens must expire.
• Code written for php-jwt 5 passes the PEM as a plain string. Version 7 then fails with the misleading "kid" empty, unable to lookup correct key — the fix is not a kid but wrapping the PEM in new Key($pem, 'ES256'), which is also what prevents algorithm confusion.
• For keys published as a JWKS, use JWK::parseKeySet (or CachedKeySet) and let the token's kid select the key; a mismatch raises the kid error rather than a signature error.

Related recipes

• How to verify an ECDSA signature in PHP
• How to convert an ECDSA signature between DER and raw in PHP
• How to verify an ES256 JWT in Ruby
• How to verify an ES256 JWT in Python
• How to verify an ES256 JWT in Node.js