Overview
This tutorial shows you how to authenticate to the Issuing API using PHP by generating signed JSON Web Tokens (JWTs).
Prerequisites
- PHP 7.4 or higher
- Composer for dependency management
- Your Issuing API credentials (Access Key and RSA key pair)
Install required dependencies:
Step 1: Create signJWT function
Create a function to handle JWT signing with SHA256 body hashing:
Important Notes:
- Request body is hashed with SHA256 before signing
- 30 second expiration for security
- Private key format: PKCS8 format from file
Step 2: Usage - GET Request
To use the signJWT function when making a GET request to /v1/ping:
Step 3: Usage - POST Request
To use the signJWT function when making a POST request to /v1/ping:
Common Pitfalls
Body Hashing is Critical! The request body must be hashed with SHA256 before being included in the JWT claims. Make sure you pass the exact same request body to both signJWT() and your HTTP client.
Token Expiration: JWT tokens expire after 30 seconds. Generate a fresh token for each API request to avoid authentication errors.
Next Steps