Перевод данных в JWT

{
  "alg": "HS256"
}
 
{
  "name": "Roma",
  "family": "Romov"
}
 
secret

<?php
 
$encoded_header = base64_encode('{"alg": "HS256","typ": "JWT"}');
$encoded_payload = base64_encode('{"score": "12","name": "Crille"}');
 
$header_and_payload_combined = $encoded_header . '.' . $encoded_payload;
 
$secret_key = 'thisismysecretkey';
 
$signature = base64_encode(hash_hmac('sha256', $header_and_payload_combined, $secret_key, true));
 
$jwt_token = $header_and_payload_combined . '.' . $signature;
 
echo $jwt_token;

#recieved_jwt would in real life be populated from a $_POST['values'] but for this example this will work
$recieved_jwt = 'eyJhbGciOiAiSFMyNTYiLCJ0eXAiOiAiSldUIn0=.eyJzY29yZSI6ICIxMiIsIm5hbWUiOiAiQ3JpbGxlIn0=.Or5OIu2KjpE6/rQeg0yDyAjBX7KGlHqRJBBTZYgi3I0=';
$secret_key = 'thisismysecretkey';
 
$jwt_values = explode('.', $recieved_jwt);
 
$recieved_signature = $jwt_values[2];
$recieved_header_and_payload = $jwt_values[0] . '.' . $jwt_values[1];
 
$what_signature_should_be = base64_encode(hash_hmac('sha256', $recieved_header_and_payload, $secret_key, true));
 
if($what_signature_should_be == $recieved_signature) {
    // signature is ok, the payload has not been tampered with
}

$encoded_payload = base64_encode('{"eml": "'.$email.'"}');

$payload = base64_decode($jwt_values[1]);
$email = $payload['eml'];