Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Piro's avatar
Level 1

Authenticate with JWT-AUTH

Good morning buddies! I'am IOS developer and create an API in laravel to request some data. I'am new in laravel and i trying to authenticate some user but no success. The documentation of jwt-auth is a little confuse to me, do four days I'm trying learn this documentation and nothing happen. Somebody can help me? How it works?

the route...

Route::get('api/login', ['middleware'=>'jwt.auth', 'uses' => 'AuthenticateController@authenticate']);

the AuthenticateController

<?php 

use JWTAuth;
use Tymon\JWTAuth\Exceptions\JWTException;

class AuthenticateController extends Controller
{
    public function authenticate(Request $request)
    {
        // grab credentials from the request
        $credentials = $request->only('email', 'password');

        try {
            // attempt to verify the credentials and create a token for the user
            if (! $token = JWTAuth::attempt($credentials)) {
                return response()->json(['error' => 'invalid_credentials'], 401);
            }
        } catch (JWTException $e) {
            // something went wrong whilst attempting to encode the token
            return response()->json(['error' => 'could_not_create_token'], 500);
        }

        // all good so return the token
        return response()->json(compact('token'));
    }
}

When i try request i get this error...

{"error":"token_not_provided"}

0 likes
2 replies
taijuten's avatar

I could be mistaken, but I don't think you want the middleware on that route, otherwise you're requiring the user to be logged in before the controller will run.

2 likes
gronpen's avatar

the previous reply is correct. Your auth method excepts a request containing an email and password (it's in your code: $credentials = $request->only('email', 'password');) , which will be checked against the user database for authentication without JWT.

Once you authenticate, the controller returns a JWT that you need to keep and send in a header with every other request for a route that passes through the jwt.auth middleware.

This should be helpful https://github.com/tymondesigns/jwt-auth/wiki/Authentication

Please or to participate in this conversation.