JWTs

Overview

Issue, validate, refresh, revoke, and list AAM JWTs for a user. Select the subject with AAM::api()->jwts($access_level, $settings). Omit $access_level to use the current user or visitor.

PHP class: AAM_Framework_Service_Jwts.

Method reference

Method	Purpose
`get_tokens()`	List registered JWTs.
`tokens()`	Alias of `get_tokens()`.
`get_token_by($search, $claim = null)`	Find a registered JWT.
`token_by($search, $claim = null)`	Alias of `get_token_by()`.
`issue(array $claims = [], array $settings = [])`	Issue a JWT.
`revoke($token)`	Revoke a registered JWT.
`refresh($token)`	Refresh a refreshable JWT.
`validate($token)`	Validate a JWT.
`reset()`	Remove one rule or all rules for this level.

Return values vary by method. Rule updates usually return bool; reads can return a value, null, or an array. Errors follow the service’s error_handling setting and may produce WP_Error.

Accepted identifiers

This service is bound to a user access level; it has no separate resource identifier. Pass the JWT string to validate($token), refresh($token), or revoke($token). get_token_by($search, $claim) searches by token when $claim is omitted, or by a claim value when a claim name is supplied. issue() takes claim and settings arrays.

Example

$tokens = AAM::api()->jwts('user:42');
$issued = $tokens->issue([], ['ttl' => 3600, 'revocable' => true]);

The first argument to issue() is a claims array; the second contains token settings. This issues a revocable token for user 42 with a one-hour lifetime, and $issued contains token details.

Developer notes

JWT issuance requires a user access level. issue() returns token details or an error, not a bare token string.
Store the signing secret or key securely and use expiration and revocation appropriate to your application.
The selected access level determines whose rules are stored or evaluated. See Access levels.

Behavior and parameters

issue($claims = [], $settings = []) returns token details. Settings include ttl (seconds or a relative time string), revocable, refreshable, and optional description. Claims are payload claims; do not place the TTL setting there.
validate($token) checks signature, expiry, and revocation where applicable. revoke($token) removes a revocable token from the registry. refresh($token) requires a refreshable token. get_tokens() lists registry entries and get_token_by() finds one.
reset() removes this user’s registered tokens. Revocable tokens use the registry; non-revocable tokens cannot be recalled through it. Prefer short lifetimes for non-revocable tokens.
Configure a signing secret or key through AAM configuration before issuing tokens. Never expose the raw signing material in application output.