Laravel Token Auth

Table of contents

• Introduction
• Installation
• Quick start
  • Protect routes
  • Revoke tokens
  • Prune revoked / expired tokens

See the detailed documentation at: /docs

Introduction

Laravel Token Auth provides functionality to authenticate Laravel APIs using access and refresh tokens.

It is heavily inspired by Laravel Sanctum.

Refresh tokens

Refresh tokens are used to create new access tokens. This way an access token can have only a short expiration time without the need for the user to login again.

To keep these refresh tokens save we can implement refresh token rotation. When a new access token is requested using a refresh token, the new access token and a new refresh token is returned. The used refresh token is then revoked but kept in the database. This way it can be detected if a refresh token is reused.

For more details see: https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/

Installation

^ back to top ^

If you want to customize the migrations, configuration run the publish command:

If you only want to customize parts you can run the following:

• Migrations: php artisan vendor:publish --tag="token-auth-migrations"

• Configuration: php artisan vendor:publish --tag="token-auth-config"

Next you should run the migrations:

Quick start

^ back to top ^

Add the HasAuthTokens trait to the Eloquent user model:

Add the following routes for authentication:

Info: Of course you should create your own controllers for this. This is just a simplification.

Protect routes

Revoke tokens

Prune revoked / expired tokens