Symfony JWT Authentication

When to use

• The user must configure a Symfony firewall for JWT — the login entry point, the api firewall, and the token authenticator in security.yaml.
• The user needs to authenticate a Symfony API statelessly with JWT tokens issued and verified by LexikJWTAuthenticationBundle.
• The user wants to set the JWT token TTL, add refresh tokens, or build a custom Symfony authenticator for token handling.

When NOT to use

• Do not use this skill for JWT outside Symfony's security component, such as a Laravel guard, a raw firebase/php-jwt integration, or another framework.
• Do not reach for JWT when a stateful, session-based form login already fits a server-rendered Symfony web app.

Core guidance