- How do I install amin3536/passport-otp-grant in Laravel?
- Install the package with Composer using composer require amin3536/passport-otp-grant. Then follow the repository setup steps to register the custom Passport grant and configure your OTP client. Make sure Laravel Passport is already installed and configured in your application.
- What does the OTP grant type do in Laravel Passport?
- It adds a custom OAuth2 grant to Laravel Passport that lets a client submit a one-time password instead of a user password. Passport validates the grant and returns access tokens when your OTP verification succeeds. This enables passwordless API authentication flows.
- Does this package support passwordless login for mobile APIs?
- Yes, the main use case is passwordless login for API and mobile clients. Users can authenticate with an SMS or email code rather than remembering and sending a password. Your app remains responsible for generating, delivering, and verifying the code.
- Which Laravel and Passport versions are supported?
- The supported Laravel and Passport versions are declared in the package composer.json. Check those constraints before installing, especially if you are upgrading Laravel or Passport. The package is intended for applications already using Laravel Passport.
- How do I configure the OTP grant in Passport?
- You configure it by registering the package's custom grant with Passport and enabling that grant type for your OAuth client or token request. The exact registration snippet and request parameters should come from the package README. You also need to connect the grant to your own OTP validation logic and user resolution.
- Does the package send SMS or email OTP codes?
- No, this package handles the Passport grant and token exchange, not SMS or email delivery. You generate the code, send it through your provider, store it with an expiry, and verify it before the grant issues tokens. That separation lets you use any notification channel.
- How should I validate and store one-time passwords securely?
- Store OTPs as hashes where possible, give them a short expiry, and mark them single-use after successful verification. Apply rate limits per user, phone number, IP, and client to reduce brute-force abuse. Never log raw codes, and avoid revealing whether a phone number or email exists.
- How do I request an access token with an OTP in tests?
- Use Laravel's HTTP testing helpers to call your OAuth token endpoint with the OTP grant parameters documented by the package. Mock or fake your OTP verification service so tests do not depend on SMS or email delivery. Assert that a valid code returns a token and that expired or reused codes are rejected.
- Is this package production-ready for high-traffic authentication?
- It can be used in production, but the grant is only one part of a secure OTP system. You must add rate limiting, code expiry, single-use enforcement, abuse monitoring, and reliable delivery. Review the package code and test your token endpoint under load before relying on it for critical authentication.
- What are alternatives to Passport OTP grant for Laravel passwordless auth?
- Alternatives include Laravel Sanctum with a custom OTP endpoint, Laravel Fortify for first-party authentication flows, or a custom Passport grant built in-house. Passport's password grant is not a passwordless alternative because it still requires a password. Choose based on whether you need full OAuth2 or simpler API tokens.