BearerTokenAuthenticator
Validates an Authorization: Bearer token via a TokenValidatorInterface (JWS verify + iss/aud), derives its ClientType via a ClientTypeResolverInterface, and resolves the identity via UserProviderInterface::loadByToken().
Always stateless: identity is re-derived from the token every request. A service client type is what flips a request to auth.sessionless (applied by StatelessAuthenticationMiddleware, not here).
Synopsis
Section titled “Synopsis”final class BearerTokenAuthenticator implements AuthenticatorInterface
| Implements | AuthenticatorInterface |
| Since | 1.0.0 |
| Source | BearerTokenAuthenticator.php |
Constructor
Section titled “Constructor”__construct()
Section titled “__construct()”public function __construct(TokenValidatorInterface $validator, ClientTypeResolverInterface $clientTypeResolver, UserProviderInterface $userProvider): mixed
Resolves the validated claims to an identity.
| Parameter | Type | Description |
|---|---|---|
$validator | TokenValidatorInterface | Verifies the token’s signature and iss/aud/time claims. |
$clientTypeResolver | ClientTypeResolverInterface | Derives human-vs-machine from the validated claims. |
$userProvider | UserProviderInterface | Resolves the validated claims to an identity. |
Returns mixed
Methods
Section titled “Methods”| Method | Description |
|---|---|
authenticate(ServerRequestInterface $request): Passport | |
onFailure(AuthenticationException $exception): null | |
supports(ServerRequestInterface $request): bool |
authenticate()
Section titled “authenticate()”public function authenticate(ServerRequestInterface $request): Passport
The incoming request.
| Parameter | Type | Description |
|---|---|---|
$request | ServerRequestInterface | The incoming request. |
Returns Passport — The resolved identity, always stateless (re-derived from the token every request).
| Throws | When |
|---|---|
AuthenticationException | If the token is missing, invalid, or its claims don’t resolve to a known identity. |
onFailure()
Section titled “onFailure()”public function onFailure(AuthenticationException $exception): null
The exception thrown by authenticate().
| Parameter | Type | Description |
|---|---|---|
$exception | AuthenticationException | The exception thrown by authenticate(). |
Returns null — Always null: defers to the firewall’s HttpChallengeEntryPoint.
supports()
Section titled “supports()”public function supports(ServerRequestInterface $request): bool
The incoming request.
| Parameter | Type | Description |
|---|---|---|
$request | ServerRequestInterface | The incoming request. |
Returns bool — True if $request carries an Authorization: Bearer header, otherwise false.