Download the PHP package laraveldaily/api-starter-kit without Composer

Laravel API Starter Kit

A Laravel API-only starter kit: token-based authentication and account management as plain, readable Laravel code. No front-end, no Vite, no Fortify — just controllers, Form Requests, API Resources, and a green test suite.

Disclaimer: this starter kit was built fully by Claude Fable 5 model, after deep planning session and a few building iterations. So it wasn't a one-shot or vibe-coding, but LLM did all the implementation work.

Features

• Token auth via Laravel Sanctum personal access tokens — DB-backed, revocable, works for mobile, SPA, and CLI clients.
• Code-based password reset — the API emails a 6-digit code, the client posts it back. No reset links, no FRONTEND_URL, no assumption about your front end.
• OpenAPI docs via Scramble at /docs/api.
• Fully tested — a Pest feature test for every endpoint; php artisan test is green immediately after install.

Installation

The installer asks two questions:

• Which testing framework do you prefer? Pick Pest — the kit's test suite is already written with it.
• Would you like to run npm install and npm run build? Answer No — this kit ships no front-end, so there is nothing to install or build. (The installer asks this for every starter kit; it cannot be skipped from the kit's side on current installer releases.)

Or with Composer directly (no prompts at all):

Either way you get a generated APP_KEY, an SQLite database, and migrated tables out of the box. Start the server with:

The mailer defaults to MAIL_MAILER=log, so password reset codes land in storage/logs/laravel.log — the whole auth flow works with zero mail setup.

Endpoints

All routes live under /api/v1. Authenticated routes expect an Authorization: Bearer <token> header. All responses (including errors) are JSON.

Register

device_name is optional everywhere a token is issued; it defaults to api.

Login

Returns the same { token, token_type, user } shape as register. Invalid credentials return 422 with an email error. Login is throttled to 5 attempts per minute per email + IP.

Logout

Revokes the token used to authenticate the request.

Returns 204 No Content.

Forgot password

The response is identical whether or not the account exists, so callers cannot enumerate emails. When the account exists, a 6-digit code is emailed (logged, by default) and is valid for 15 minutes (config/auth.php → passwords.users.expire).

Reset password

A successful reset deletes the code (single use) and revokes every token the user holds. A missing, expired, or wrong code always returns the same generic 422:

Brute-force note: the 6-digit code is protected by throttling (5 requests per minute per email + IP), the 15-minute expiry, and single-use deletion. Tighten further (longer code, attempt counter) if your threat model needs it.

Get the current user

Update profile

Send only the fields you want to change. Emails are normalized to lowercase.

Returns the updated user. Email changes take effect immediately — there is no verification flow in v1 (see Future add-ons).

Change password

Every other token is revoked; the token that made the request keeps working.

Delete account

Returns 204 No Content. All tokens are revoked and the user row is deleted.

List tokens

Token hashes are never exposed.

Revoke one token

Returns 204 No Content, or 404 when the token does not exist or belongs to another user.

Revoke all other tokens ("log out everywhere")

Returns 204 No Content. Every token except the current one is revoked.

Error shapes

All /api/* errors render as JSON:

Rate limiting

Defined in app/Providers/AppServiceProvider.php:

API documentation

Interactive OpenAPI 3.1 docs are generated from the code by Scramble:

• GET /docs/api — UI
• GET /docs/api.json — OpenAPI document

Both are restricted to the local environment by the viewApiDocs gate in app/Providers/AppServiceProvider.php; relax that gate to expose them elsewhere.

Token expiration

Tokens do not expire by default. Set expiration (minutes) in config/sanctum.php to give every token a lifetime.

CORS

config/cors.php allows all origins for api/* — safe for token auth because no cookies or credentials are involved. Pin allowed_origins in production if you prefer.

Development

Future add-ons

Deliberately not in v1, and designed to bolt on cleanly:

• Email verification — re-add MustVerifyEmail to User plus the verify/resend endpoints; the email_verified_at column already exists.
• Two-factor authentication (TOTP + recovery codes).
• Social login via Laravel Socialite.
• OAuth2 via Laravel Passport (third-party authorization).
• Teams / organizations, roles & permissions.

License

The MIT License.