- How do I install and register Laravel Nemesis?
- Install the package with Composer using andydefer/laravel-nemesis. It registers through a Laravel service provider and exposes a nemesis middleware alias, so you can attach it to route groups without changing controllers. Publish the config and migrations, run the migrations, then issue tokens with the provided Artisan commands.
- Which Laravel and PHP versions does andydefer/laravel-nemesis support?
- The available notes do not state supported Laravel or PHP versions or a support window. Because this is a v1.0.0 early-stage package, check the repository's composer.json and release notes before adopting it. Do not assume compatibility with your Laravel version until you confirm it.
- How does per-domain token quota enforcement work in Laravel Nemesis?
- Tokens belong to a domain, and each token carries CORS settings and quotas. The nemesis middleware checks the token on incoming requests, increments a request counter, and blocks traffic when the quota is exceeded. Artisan commands let operators create, reset, block, unblock, and list tokens.
- Is token extraction from the query string secure in Laravel Nemesis?
- The package supports a ?token= query parameter in addition to the Authorization header. That convenience is risky because credentials can leak into access logs, proxy logs, browser history, and referrer headers. For externally exposed APIs, confirm whether query-param extraction is disabled by default and turn it off if it is not.
- Does Laravel Nemesis replace Sanctum or Passport?
- No. Nemesis is an additive authorisation and quota gate, not an OAuth2 or full authentication replacement. Use Sanctum or Passport when you need scopes, delegated user consent, or token refresh flows, and layer Nemesis after identity is established for per-domain quotas and CORS.
- Is the quota counter atomic under concurrent requests in Laravel Nemesis?
- The notes do not confirm whether the quota increment uses a single atomic update or a read-modify-write pattern. The package advertises an optimised counter increment, which suggests concurrency was considered, but accuracy under load is not documented. Review the source or run a load test before relying on exact quota enforcement.
- What happens if the quota store is unavailable, fail-open or fail-closed?
- The provided evaluation does not state the middleware behavior when the quota store is unreachable. In practice it must either block all traffic or silently permit it, and both defaults are dangerous without an explicit policy. Confirm the current behavior and configure fail-open or fail-closed handling before production use.
- Are API tokens stored hashed at rest in Laravel Nemesis?
- The available documentation does not specify whether tokens are hashed at rest or stored as plaintext. Because these tokens grant API access, hashed storage is important for database and backup exposure. Inspect the migrations and source, and ask the maintainer if the French-only docs leave it unclear.
- Does Laravel Nemesis have tests, CI, and a security disclosure process?
- The evaluation found no evidence of test coverage, continuous integration, static analysis, or a security contact for disclosure. The package is v1.0.0 under MIT with a single maintainer, so bus factor and review burden are material risks. Plan your own integration tests and a security review before production adoption.
- Can I use Laravel Nemesis for internal service-to-service or partner API quotas?
- Yes, it is best suited to Laravel APIs with many machine clients partitioned by domain or tenant. That includes internal service-to-service calls, partner integrations, and trial or sandbox tiers where coarse-grained per-token quotas and simple token lifecycle are enough. For OAuth2 scopes or delegated consent, keep Sanctum or Passport for identity and use Nemesis only for quota and domain policy.