<?php
use \Firebase\JWT\JWT;
# Generate a private key to sign the token.
# The public key would need to be published at the authorization
# server if a separate resource server needs to validate the JWT
$private_key = openssl_pkey_new([
  'digest_alg' => 'sha256',
  'private_key_bits' => 1024,
  'private_key_type' => OPENSSL_KEYTYPE_RSA
]);
# Set the user ID of the user this token is for
$user_id = "1000";
# Set the client ID of the app that is generating this token
$client_id = 'https://example-app.com';
# Provide the list of scopes this token is valid for
$scope = 'read write';
$token_data = array(
  # Issuer (the authorization server identifier)
  'iss' => 'https://' . $_SERVER['PHP_SELF'],
  # Expires At
  'exp' => time()+7200, // Valid for 2 hours
  # Audience (The identifier of the resource server)
  'aud' => 'api://default',
  # Subject (The user ID)
  'sub' => $user_id,
  # Client ID
  'client_id' => $client_id,
  # Issued At
  'iat' => time(),
  # Identifier of this token
  'jti' => microtime(true).'.'.bin2hex(random_bytes(10)),
  # The list of OAuth scopes this token includes
  'scope' => $scope
);
$token_string = JWT::encode($token_data, $private_key, 'RS256');

{
   "typ":"JWT",
   "alg":"RS256"
 }

{
  "iss": "https://authorization-server.com/",
  "exp": 1637344572,
  "aud": "api://default",
  "sub": "1000",
  "client_id": "https://example-app.com",
  "iat": 1637337372,
  "jti": "1637337372.2051.620f5a3dc0ebaa097312",
  "scope": "read write"
}

$public_key = openssl_pkey_get_details($private_key)['key'];
try {
  # Note: You must provide the list of supported algorithms in order to prevent 
  # an attacker from bypassing the signature verification. See:
  # https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/
  $token = JWT::decode($token_string, $jwt_key, ['RS256']);
  $error = false;
} catch(\Firebase\JWT\ExpiredException $e) {
  $token = false;
  $error = 'expired';
  $error_description = 'The token has expired';
} catch(\Firebase\JWT\SignatureInvalidException $e) {
  $token = false;
  $error = 'invalid';
  $error_description = 'The token provided was malformed';
} catch(Exception $e) {
  $token = false;
  $error = 'unauthorized';
  $error_description = $e->getMessage();
}
if($error) {
  header('HTTP/1.1 401 Unauthorized');
  echo json_encode(array(
    'error'=>$error, 
    'error_description'=>$error_description
  ));
  die();
} else {
  // Now $token has all the data that we encoded in it originally
  print_r($token);
}