Laravel Passport - Personal Access Client signature

[nkzx]

Hello,

I'm having problems with Laravel Passport and more specifically with the generation of Personal Access Tokens.

I'm currently using Laravel Passport and the classic version of OAuth 2 to authorise access to user data for third-party applications.

I now want to generate Personal Access Tokens for another client.
Implementation is quick and efficient, and I can generate tokens without any problems.
Out of curiosity I wanted to check the signature but unfortunately I can't manage to generate the same signature manually.

Here is a sample of the code i used to test :

  public function verifyToken($token, $key){
          $explodedToken = explode('.', $token);
          $header = json_decode(base64_decode($explodedToken[0]));
          $payload = json_decode(base64_decode($explodedToken[1]));
          $headerReEncoded = rtrim(strtr(base64_encode(json_encode($header)), '+/', '-_'), '=');
          $payloadReEncoded = rtrim(strtr(base64_encode(json_encode($payload)), '+/', '-_'), '=');
          $signatureEncoded = rtrim(strtr(base64_encode(hash_hmac('SHA256', "$explodedToken[0].$explodedToken[1]", $key, true)), '+/', '-_'), '=');

        if($explodedToken[0] === $headerReEncoded &&
            $explodedToken[1] === $payloadReEncoded &&
            $explodedToken[2] === $signatureEncoded){
            dump('Token is valid');
        } else {
            dump('Token is invalid');
        }
        dd([
            "original header  :     " => $explodedToken[0],
            "reencoded header :     " => $headerReEncoded,
            "original payload  :    " => $explodedToken[1],
            "reencoded payload :    " => $payloadReEncoded,
            "original signature  :  " => $explodedToken[2],
            "reencoded signature :  " => $signatureEncoded
        ]);

    }
$token = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiI3IiwianRpIjoiMzI1ZDQyMTM1ZjE2MmJhZThkYzQ1YTMzYWRjNDE3NTZmZDU1N2M2NzU0NGYwMTE4MWE4ZmI4ZTFhNzU5MmRiYzQwYjRkMTllM2IyMzA1NWEiLCJpYXQiOjE3NDk3MTY5ODMuODk2NDc5LCJuYmYiOjE3NDk3MTY5ODMuODk2NDgsImV4cCI6MTc4MTI1Mjk4My44NDU2LCJzdWIiOiI1OCIsInNjb3BlcyI6W119.FxM85j9281YI4EOyI6R89pYtyP0QSPLeVQHSxIn-Cv1zHQbZTAVcgdqhj6QEt78353_7bHesHx2etWpEnIPtI0zEP8q0heaDSo87ThoDD9AC7Q0v01l811bYfHJQnWx7NwotnVTks5h4dBGiPOqLcFEEGig3T6oHPRym3QRdxGLvOduwm-eQvD4GzWkP6Q5lK2n7ZTJ2zkis_nyHsJYVyVf1B8ElVBkXO6QFbdJ_S_BrpnH6Dw0BtoOk6c5VH45ith9YyOvLRenEstzjJKWwt4ad9hNJ9qr0UONGqWTeyoSCtnh6pZx9qc5Q17XOFZmscOZ8iJ0SnxaD37jILFfiLIDlP-573SfJ8hXcRFXtLCjW_rZ85EwmCurqw0kjdoVEiT1uKHBb_WeD2Dp4MnNoh2fflx9-ykqeo856adO7OWHLYgaYHM6UhmSnM8IVvOd69ryxRHglp0IvdD_vjeC0wYT1gYbCMD9B32606eeDpzjzPxYKOogJBUibiqCTUzBVm-pquB1rIE5lCNlcR-Ug8iZL_G51hqt_dueeZJlXqWI6Du8t7Vz_noRJ2-COL7v2gwytoke0BM3R3EDW0653v0yhlXOm9AIUDxRYzu35ukG957FyVpaaBdHPqaiza7L2rlRPvmsjOcuhdo-XSpY5D3vqYpLPBwWpQrD7tsFitvQ';
        $key = 'PEyqzg0JwWVrP2fW9Kv1Y1xxzCv5IBlL3RAo8W02';
        $this->verifyToken($token, $key);

The token was generated via the /oauth/personal-access-tokens route.

Any ideas ? algorithm used or function to verify the signature is wrong ?

Thanks

[sts19813]

The token is not signed with the personal access client's secret.

The decoded header says "alg": "RS256", so Passport used an RSA private key to sign it. The corresponding RSA public key verifies it. hash_hmac('sha256', ...) implements HS256, which is a different algorithm, and a Passport client secret is not a JWT signing key.

If you need to verify the signature manually, verify the original first two JWT segments without decoding and re-encoding them:

function base64UrlDecode(string $value): string
{
    $padding = (4 - strlen($value) % 4) % 4;

    return base64_decode(
        strtr($value, '-_', '+/').str_repeat('=', $padding),
        true
    );
}

[$header, $payload, $signature] = explode('.', $accessToken);

$publicKey = file_get_contents(storage_path('oauth-public.key'));

$result = openssl_verify(
    $header.'.'.$payload,
    base64UrlDecode($signature),
    $publicKey,
    OPENSSL_ALGO_SHA256,
);

if ($result !== 1) {
    throw new RuntimeException('Invalid access-token signature.');
}

The public key is normally generated with Passport's passport:keys command. It may also be supplied through Passport's configured key path or the PASSPORT_PUBLIC_KEY environment variable. Never distribute the private key.

Do not decode and then re-encode the header or payload before verification: JWT signatures cover the exact Base64URL text that was issued, and a semantically identical JSON object can have different bytes.

A valid signature alone is not sufficient for authorization. You must also validate time and audience/issuer claims as applicable, scopes, and whether Passport considers the token revoked. For an API endpoint, the safer option is to let Passport's guard / League OAuth2 resource-server middleware perform the complete validation instead of implementing only the signature check.

Passport key documentation: https://laravel.com/docs/11.x/passport#deploying-passport

[maulanaa121]

I don't think you should manually verify the Passport access token using hash_hmac().

Laravel Passport already handles access-token validation through its authentication guard. You can protect your API route with Passport:

Route::get('/user', function (Request $request) {
    return $request->user();
})->middleware('auth:api');

Then send the token as a Bearer token:

Authorization: Bearer YOUR_ACCESS_TOKEN

Passport will handle the token parsing and signature/expiration/revocation checks for you.

If you really need to inspect or verify the JWT manually, you should use a JWT library and verify it using Passport's configured public key and the algorithm specified by the token, rather than recreating the signature with hash_hmac('SHA256', ...).

So the main issue with the current implementation is that it is trying to reproduce Passport's token verification logic manually.