PHP JWT Authentication API Example with Refresh Token Rotation

What SecureCoreAuth Does

SecureCoreAuth provides a secure PHP JWT authentication API for login, token refresh, logout and protected route access. It is designed for developers who need a clean authentication backend without building the full auth flow from scratch.

The system uses short-lived access tokens, refresh token rotation and database-backed token invalidation for stronger session control.

Authentication Flow

1. User sends credentials to the login endpoint.
2. API validates credentials and returns an access token and refresh token.
3. Client uses the access token for protected API requests.
4. When the access token expires, the refresh endpoint issues a new token pair.
5. Refresh tokens can be invalidated from the database for logout or session control.

Login → Access Token + Refresh Token
Protected Request → Authorization: Bearer ACCESS_TOKEN
Refresh → New Access Token + New Refresh Token
Logout / Invalidate → Refresh Token Revoked

Login Endpoint

Use this endpoint to authenticate a user and receive JWT tokens for protected API access.

Example Request Body

{
  "email": "user@example.com",
  "password": "your-password"
}

Example Response

{
  "message": "Login successful",
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token": "7c97f0d9b0e24f3d8d01c98f2e8f8a5d"
}

Refresh Token Endpoint

This endpoint rotates the refresh token and returns a new access token pair. It is the core of refresh token rotation and secure session renewal.

Example Request Body

{
  "refresh_token": "7c97f0d9b0e24f3d8d01c98f2e8f8a5d"
}

Example Response

{
  "message": "Token refreshed successfully",
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token": "c631123c3c324de58f4d4b88d310ef38"
}

Protected Route Example

Use the access token in the Authorization header to fetch the current authenticated user.

Request Header

Authorization: Bearer YOUR_ACCESS_TOKEN

Example Response

{
  "id": 1,
  "email": "user@example.com",
  "role": "admin"
}

How to Use This in Your Project

This documentation page exists for two reasons:

• Developers get a quick technical overview of the authentication flow.
• Google gets a clear page focused on PHP JWT authentication API terms.

Where this page fits

• Homepage sells the product.
• API Demo lets developers test endpoints.
• Documentation captures technical search traffic.

Internal Links to Keep

• Homepage
• API Demo Console
• Buy SecureCoreAuth