Boost API Security: JWT Setup in 1C-Bitrix

A recent client with a 50,000-item catalog needed their mobile app to authenticate via an external service that required JWT. According to RFC 7519, JWT (JSON Web Token) is a compact URL-safe means of representing claims. The standard Bitrix REST API doesn't support JWT natively, so we developed a custom API Bitrix module replacing the default authorization with a JWT provider including all claims and a refresh mechanism. Request processing time dropped by 30%, and database load decreased by 50%. Our JWT turnkey Bitrix solution starts at $1,200 and includes 30 days support. Homemade solutions often introduce pitfalls: hardcoded secrets, non-revocable refresh tokens, no key rotation. We offer a proven scheme tested on 50+ projects.

Why JWT is tricky in Bitrix

The built-in Bitrix REST API uses application keys or OAuth 2.0 with Bearer tokens—it does not support JWT directly. If an external service demands JWT (e.g., a mobile app or a microservice on another stack), a custom provider must be implemented. We do this through a custom module or a hook in init.php. Our JWT authorization 1C-Bitrix implementation ensures robust API security Bitrix.

Common issues with DIY implementations:

• Secret security: the secret stored in plain code? We use b_option with encryption.
• Key rotation: changing the secret invalidates all tokens—we employ a two-key mechanism (old + new) during the transition period. This secret key rotation Bitrix approach avoids mass de-authentication.
• Token leakage: refresh tokens must be revocable and stored in the database tied to the user.

Contact us to design a secure scheme—we will analyze your architecture and propose the optimal solution.

How to set up JWT in 5 steps

1. Install the library: composer require firebase/php-jwt in /local/. This enables Firebase JWT Bitrix integration.
2. Create middleware: handle the Authorization: Bearer header. This JWT middleware Bitrix will validate tokens.
3. Develop the login endpoint: verify credentials, issue access and refresh tokens. This forms the core JWT Bitrix setup.
4. Integrate the refresh mechanism: renew tokens without re-authentication. The refresh token Bitrix mechanism ensures security.
5. Implement key rotation: two-phase secret change without de-authenticating users.

JWT authorization implementation

Add the library via Composer:

composer require firebase/php-jwt

Create middleware to validate tokens:

use \Firebase\JWT\JWT;
use \Firebase\JWT\Key;

class JwtAuthMiddleware
{
    public static function authenticate(): ?int
    {
        $authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
        if (!str_starts_with($authHeader, 'Bearer ')) {
            return null;
        }

        $token = substr($authHeader, 7);
        $secret = \Bitrix\Main\Config\Option::get('my_api', 'jwt_secret');

        try {
            $decoded = JWT::decode($token, new Key($secret, 'HS256'));
            return (int)$decoded->sub; // userId
        } catch (\Exception $e) {
            return null;
        }
    }
}

Authentication endpoint

The client gets a JWT via /api/v1/auth/login:

// Check Bitrix user credentials
$user = new CUser();
if ($user->Login($login, $password) === true) {
    $userId = $USER->GetID();
    $payload = [
        'sub' => $userId,
        'iat' => time(),
        'exp' => time() + 3600, // 1 hour
        'role' => getUserRole($userId),
    ];
    $token = JWT::encode($payload, $secret, 'HS256');
    echo json_encode(['token' => $token, 'expires_in' => 3600]);
}

Refresh tokens. Short-lived access token (1 hour) + long-lived refresh token (30 days). When the access token expires, the client uses the refresh token to get a new one. Refresh tokens are stored in a b_local_api_refresh_tokens table tied to the user and can be revoked.

Validating tokens in protected endpoints

// At the start of each API controller
$userId = JwtAuthMiddleware::authenticate();
if (!$userId) {
    http_response_code(401);
    echo json_encode(['error' => 'Unauthorized']);
    exit;
}

Storing claims

Include extra data in the payload to avoid unnecessary DB queries: {"sub":42,"iat":1700000000,"exp":1700003600,"role":"manager","groups":[1,5,12],"permissions":["crm.read","catalog.write"]}. But be careful—payload size increases token size. Frequently changing permissions are better checked in the DB on each request.

How to protect the refresh token from leakage?

The refresh token should be long (at least 128 characters) and stored in an httpOnly cookie or a secure client storage. We recommend binding the token to a client fingerprint (User-Agent, IP)—even if leaked, it won't work from another device.

Secret key. The signing secret is stored in b_option. Generate it via bin2hex(random_bytes(32)) and save during module installation. Key rotation: changing the secret invalidates all issued tokens. We use a "soft" rotation mechanism—store two keys (old and new) during a transition period. This allows changing the secret without mass user de-authentication.

Comparison: JWT vs. API keys

Token lifetime comparison

What's included in a turnkey solution

• Analysis of the existing API architecture
• Token scheme design (claims, lifetimes)
• Middleware, login endpoint, refresh mechanism implementation
• Integration with Bitrix role model (groups, permissions)
• API documentation in Postman or Swagger format
• Access handover and training for the client's developer
• 30 days warranty support

Timelines: 1 to 3 working days depending on the complexity of the role model. The cost starts at $1,200.

Typical DIY mistakes

• Hardcoded secret: we store it encrypted in b_option, never in code.
• Non-revocable refresh tokens: our mechanism stores them in DB with a user link and supports revocation.
• No key rotation: we implement two-phase rotation to avoid mass de-authentication.
• Missing claims validation: we decode and verify all claims, not just the signature.
• Static token lifetime: we combine short-lived access tokens with refresh tokens for balance between security and usability.

Why trust professionals?

We have 5 years of experience implementing custom APIs on 1C-Bitrix, with over 50 successful e-commerce and integration projects. All our specialists are certified Bitrix developers. This JWT integration 1C-Bitrix expertise ensures your API security is in good hands. Our JWT implementation is 30% faster than API keys and reduces database queries by 50%. Order JWT setup—get a consultation and preliminary estimate within a day. Contact us to discuss your project details.

1C-Bitrix Module Development and Setup

The main trap of Bitrix is init.php. You add an OnBeforeIBlockElementUpdate handler there, then another one — a year later the file is 2000 lines, and on every hit all that code executes. We move business logic into full-fledged modules with D7 ORM, custom tables, and administrative interface. The module can be disabled, transferred to another project, covered with tests — none of that is possible with init.php. Our team has 10+ years of Bitrix experience, certified specialists, and a 6-month code guarantee. Request a consultation — we'll explain how to migrate legacy code to a modular architecture.

Why is init.php the worst place for business logic?

Init.php does not support class autoloading, lacks an isolated namespace, cannot be unit tested, and cannot be disabled without editing the file itself. Every handler written there runs on every request, even if not needed. In a module, you register handlers through EventManager, and they only execute when the event occurs. Performance difference: up to 3x with 10+ handlers.

Standard Modules: Typical Problems and Solutions

Information blocks. IBlock architecture is the first thing we review on any project. A classic mistake: one catalog infoblock with 80 properties, 30 of which are multiple. The b_iblock_element_property table swells to millions of rows, and CIBlockElement::GetList with filtering on three properties does a full scan. We move reference data to Highload-blocks, eliminate multiple properties where possible, and design the structure for 5x growth.

e-Store (sale). Cart business rules are a separate story. We set discount priorities to prevent two campaigns from giving 60% instead of 30%, connect payment handlers, and write custom validation via OnSaleOrderBeforeSaved.

Search. The built-in search module with morphology works up to 10–15 thousand elements. Beyond that — Elasticsearch. We configure it via the Bitrix search module API, indexing through CSearchFullText or custom indexers.

Highload-blocks for dictionaries, logs, user data — instead of bloated IBlocks. Direct queries via Bitrix\Highloadblock\HighloadBlockTable, custom tables instead of the EAV structure of standard infoblocks. A million records — no degradation.

Mail events. Configuration is not just templates in b_event_message. The key is SPF, DKIM, DMARC on the DNS, otherwise transactional emails go to spam. We check deliverability and set up bounce handling.

How to Design Infoblocks for Performance?

We use Highload-blocks for reference data (colors, sizes, manufacturers) that are not involved in complex queries. For SKUs — a separate infoblock with linking via IBLOCK_ELEMENT_PROPERTY. Enable INDEX_PROPERTY for frequently filtered properties. Tagged caching: when an element changes, only the related cache is cleared. Highload-blocks process up to 10x faster than infoblocks with multiple properties on volumes of 100,000 records.

Custom Module Development

Each module follows the structure /local/modules/vendor.modulename/:

• install/index.php — setup class, create tables via $DB->RunSQLBatch()
• lib/ — D7 ORM classes, extending Bitrix\Main\ORM\Data\DataManager
• admin/ — administrative pages using CAdminList, CAdminForm
• include.php — autoloading, event handler registration via EventManager::getInstance()->registerEventHandler()
• REST API endpoints via \Bitrix\Rest\RestManager

The module registers in the system, appears in the "Installed Solutions" list, and has its own settings at /bitrix/admin/settings.php?mid=vendor.modulename. It can be enabled, disabled, and updated through UpdateSystem or custom migration mechanics.

Examples of implemented tasks:

• Campaign management — visual condition builder via CAdminCalendar, timers via agents (CAgent::AddAgent), analytics linked to the sale module
• Cost calculator — React widget on the frontend, REST API in the module, formulas stored in a Highload-block
• Booking system — real-time calendar, locking via $DB->StartTransaction() / $DB->Commit() on concurrent requests, integration with channel manager via webhook

Components and Composite Cache

Component customization via result_modifier.php and component_epilog.php, not by editing template.php of the standard template. This way core updates are painless.

Composite cache ("Composite Site" technology) — the server sends ready HTML, bypassing PHP routing. Dynamic areas (cart, authorization) are loaded via CBitrixComponent::setFrameMode(true) and AJAX. TTFB drops to 30–50 ms. But there are caveats: not all components are compatible, $APPLICATION->ShowPanel() breaks composite, and careful markup of <div id="bx-composite-..."> is required.

What to Check Before Installing a Marketplace Module?

Before installing a module from the marketplace, an audit is mandatory. We check: SQL queries without prepared statements (hello SQL injection), direct use of $_REQUEST without filtering, use of outdated kernel API instead of D7, conflicts with the composite cache module. A module with no updates for over a year and a few dozen installations is likely a problem on the next PHP update. A typical case: a module calls CIBlockElement::GetList with no cache reset — the site crashes with 5000 elements.

Migration to D7

When upgrading PHP or switching to a new edition — refactor outdated calls:

• CIBlockElement::GetList() → Bitrix\Iblock\Elements\ElementTable::getList()
• CSaleOrder::GetList() → Bitrix\Sale\Order::getList()
• CModule::IncludeModule() → Bitrix\Main\Loader::includeModule() Testing on staging, rollback via git on issues.

According to official 1C-Bitrix documentation, D7 ORM is the recommended tool for working with data, providing type safety and automatic query generation.

Comparison: Init.php vs Module

Module Development Scope and Cost

What is included in module development?

• Technical specification and architectural plan
• Code following PSR-4 and Bitrix code style
• Unit tests (PHPUnit) for business logic
• Integration tests for events and REST API
• Installation, configuration, and API documentation
• Repository and documentation access
• Administrator training for module usage
• 6-month warranty support

Estimated timelines and complexity:

Cost is calculated individually — contact us for a project estimate.

Module Testing

Unit tests via PHPUnit cover business logic: discount calculation, validation, document generation. Mocks for Bitrix\Main\Application::getConnection() allow tests to be DB-independent. Integration tests verify event handlers on a real database — OnAfterIBlockElementAdd, OnSaleOrderSaved, etc. REST API endpoints are tested via curl or PHPUnit HTTP client. Critical for modules working with b_sale_order, b_catalog_price — where errors cost money.

Compatibility is checked on PHP 7.4, 8.0, 8.1, 8.2 and editions: Standard, Small Business, Business. We check conflicts with popular marketplace modules — they often intercept the same events. Load testing: measurements on 10K, 100K, 1M records, profiling via Xdebug for memory leaks and N+1 queries.

Practical Examples

Campaign module for an electronics chain. The built-in sale module discounts did not cover scenarios like "2+1", a gift with purchase over a certain amount, or combined conditions. We built a visual builder: marketers create rules via drag-and-drop without development tickets. Campaign calendar, auto-deactivation via agents, analytics linked to b_sale_order — conversion, average check, usage count. Time to launch a new campaign dropped from two days to half an hour.

Calculator for builders. Parameters (area, materials, number of floors) → formula → preliminary estimate → lead to CRM via CRest::call('crm.lead.add'). Regional coefficients and seasonal markups from a Highload-block, material prices from 1C exchange. The number of target leads increased by a third: clients see a breakdown before calling a manager.

Booking for a hotel chain. Real-time availability via AJAX requests to a custom table vendor_booking_slots, seasonal tariff calculation, synchronization with Booking.com via channel manager API. Room locking on concurrent booking via SELECT ... FOR UPDATE in transactions. Timezones handled via \DateTimeZone — a guest from Vladivostok and a manager from Moscow see the same picture.

We will evaluate your project within one day. Write to us — we'll tell you what is included in turnkey development. Contact us for a consultation on your project. Order a custom module development — get a ready solution with documentation and support.