Zero‑Trust API Security in Laravel 11 with Ory Kratos, Hydra, and JWT

Why zero‑trust matters for modern Laravel APIs

Data breaches have risen by 67% since 2022, and most of them involve compromised API tokens. Laravel developers often assume that a well‑written route guard is enough, but attackers now bypass perimeter defenses with stolen credentials, replay attacks, or compromised service accounts. Zero‑trust forces every request to prove its identity and intent, regardless of network location.

Zero‑trust fundamentals applied to Laravel 11

In a zero‑trust model the backend never trusts a client by default. Each call must be authenticated, authorized, and continuously validated. Laravel 11 introduces improved route caching and signed middleware, which are perfect anchors for a strict verification pipeline. The three pillars are:

• Identity verification – who is calling?
• Access enforcement – what can the caller do?
• Session integrity – is the token still valid?

Combining these pillars with Ory Kratos (identity), Ory Hydra (OAuth2), and JWT creates a self‑contained security fabric that scales from single‑server apps to Kubernetes clusters.

Setting up Ory Kratos for identity management

Kratos stores user credentials, handles passwordless flows, and emits self‑service recovery links. Begin with the official Docker image; the minimum requirement is Docker 20.10 and 2 GB RAM. After pulling the image, start a container with a persistent volume for the SQLite database:

docker run -d \
  --name kratos \
  -p 4433:4433 -p 4434:4434 \
  -v $(pwd)/kratos:/etc/kratos \
  oryd/kratos:v0.12.0 \
  serve -c /etc/kratos/kratos.yml

Next, add the PHP SDK to Laravel:

composer require ory/kratos-client

Register a service provider that injects the Kratos client with the public endpoint:

use Ory\Kratos\Client\Configuration; 
use Ory\Kratos\Client\Api\IdentityApi; 

public function register() 
{ 
    $config = Configuration::getDefaultConfiguration() 
        ->setHost('http://localhost:4433'); 
    $this->app->singleton(IdentityApi::class, function ($app) use ($config) { 
        return new IdentityApi($config); 
    }); 
}

With the client in the service container, you can create users programmatically, e.g., during a SaaS onboarding flow.

Integrating Ory Hydra for OAuth2 and token issuance

Hydra acts as a dedicated OAuth2 server, issuing short‑lived access tokens and refresh tokens. It works seamlessly with Kratos for password‑grant or social‑login flows. Deploy Hydra similarly:

docker run -d \
  --name hydra \
  -p 4444:4444 -p 4445:4445 \
  -e DSN=memory \
  -e URLS_SELF_ISSUER=https://localhost:4444/ \
  oryd/hydra:v2.2.0 \
  serve all --dangerous-force-http

Configure Laravel to use Hydra’s introspection endpoint for token validation. Create a middleware that calls /oauth2/introspect and aborts if the token is inactive:

use Illuminate\Support\Facades\Http; 

public function handle($request, Closure $next) 
{ 
    $token = $request->bearerToken(); 
    if (!$token) { 
        abort(401, 'Missing token'); 
    } 
    $response = Http::asForm()->post('http://localhost:4444/oauth2/introspect', [
        'token' => $token,
        'client_id' => env('HYDRA_CLIENT_ID'),
        'client_secret' => env('HYDRA_CLIENT_SECRET'),
    ]); 
    $data = $response->json(); 
    if (empty($data['active'])) { 
        abort(401, 'Invalid token'); 
    } 
    // Attach user ID to request for downstream policies 
    $request->attributes->set('user_id', $data['sub']); 
    return $next($request);
}

Register the middleware on API routes that require strict verification.

Implementing JWT authentication in Laravel 11

Laravel 11 ships with a first‑class JWT guard via the tymon/jwt-auth package. While Hydra already provides JWTs, you may need to decode custom claims or enforce additional checks, such as token age or IP binding. Install the package and publish the config:

composer require tymon/jwt-auth:^1.0 
php artisan vendor:publish --provider="Tymon\JWTAuth\Providers\LaravelServiceProvider"
php artisan jwt:secret

Update config/auth.php to add a jwt guard for the api driver:

'guards' => [
    'api' => [
        'driver' => 'jwt',
        'provider' => 'users',
    ],
],

Now any route protected by auth:api will automatically validate the JWT signature against the public key you configured in .env (e.g., JWT_PUBLIC_KEY).

Practical example: Securing a sample orders API

Assume you have an endpoint /api/orders that returns a user’s purchase history. Combine the three layers:

use Illuminate\Support\Facades\Route; 

Route::middleware(['hydra.introspect', 'auth:api'])
    ->get('/orders', function (Request $request) {
        $userId = $request->attributes->get('user_id');
        // Query orders belonging to the verified user
        $orders = \App\Models\Order::where('user_id', $userId)->latest()->take(20)->get();
        return response()->json($orders);
    });

The hydra.introspect middleware guarantees the token is still active in Hydra, while the JWT guard validates the cryptographic signature and extracts custom claims like role or tenant_id. If either check fails, the request is rejected before hitting the controller, embodying zero‑trust.

Monitoring, revocation, and continuous verification

Zero‑trust does not end at the gate. Use Hydra’s revocation endpoint to invalidate tokens immediately after a password change or suspicious activity:

curl -X POST http://localhost:4444/oauth2/revoke \
  -d token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Log each introspection result to a centralized ELK stack; the logs provide audit trails that satisfy GDPR and SOC‑2 requirements. Additionally, enable Kratos’s “session refresh” flow to rotate session IDs every 15 minutes, reducing the window for replay attacks.

Conclusion

By weaving Ory Kratos, Ory Hydra, and Laravel’s native JWT guard into a layered pipeline, you achieve a true zero‑trust API surface for Laravel 11. The approach enforces identity at the edge, validates token integrity on every call, and provides built‑in mechanisms for revocation and auditing. The result is a resilient backend that can withstand credential theft, token replay, and insider threats without sacrificing developer productivity.

Sources

• Ory Kratos Official Documentation
• Ory Hydra API Reference
• Laravel 11 Authentication Guide

Author: Mahmut Sarıkaya — sarikayadev.com