Laravel Nemesis Laravel Package

Product Decisions This Supports

• Build vs. buy for API access control: Nemesis bundles three concerns we would otherwise hand-roll or stitch together — per-domain API token issuance, per-token CORS policy, and call quotas with automatic blocking. If our roadmap includes exposing APIs to multiple partners or tenants, this shortlist replaces an internal build of the token/quota layer.
• Multi-tenant and partner-facing API roadmap: Per-domain tokens are the direct enabler for scoping credentials to a tenant, environment, or partner integration. That is a scoping decision (one token per domain vs. one global key), and it changes how we model onboarding for external consumers.
• Rate-limit and abuse policy as a product surface: Automatic blocking after exceeding quotas lets us commit to a public usage policy ("X calls per period, then blocked") without bespoke engineering. This feeds pricing tiers, fair-use language in contracts, and sales collateral.
• Support and ops cost modelling: The Artisan command set (create, reset, block/unblock, list) is the operational lever. If support can reset a quota or revoke a token via CLI without an engineer, that is a measurable reduction in support escalation cost — worth validating before we commit to self-serve partner onboarding.
• Prioritisation signal for the current quarter: Because the package is MIT and small in surface area, a spike is cheap. The decision it unlocks is whether to fund an internal API gateway capability or defer it and spend the quarter elsewhere.
• Security posture decisions: Flexible token extraction (Authorization header and query params) is convenient but query-param tokens leak into logs and referrers. That is a policy call we must make explicitly rather than inherit by default.

When to Consider This Package

Adopt for evaluation when:

• We are shipping a Laravel API where consumers are known partners or tenants rather than anonymous public traffic.
• We need domain- or tenant-scoped credentials and per-token CORS without standing up an external gateway.
• We want quota enforcement with automatic blocking out of the box, and a CLI for day-two operations.
• The team is small and prefers a composable MIT package over operating Kong, Envoy, or a commercial API management platform.
• We can accept a v1.0.0 dependency from a single author, and we are willing to pin the version and review the source before production.

Look elsewhere when:

• Identity and OAuth are the real requirement. If we need user authentication, scopes, refresh tokens, or OAuth2 flows, Laravel Sanctum or Passport are the maintained, first-party answers. Nemesis manages API tokens as access-control artefacts, not as an identity system — do not let it become one by accident.
• We need horizontal scale and shared quota state. Quota counters must live somewhere all app instances agree on (Redis or the database). Confirm the storage model and race behaviour under concurrency before we promise hard limits; if we need precise distributed rate limiting, evaluate Laravel's own rate limiter or a gateway.
• Compliance or audit requirements are heavy. Single-maintainer packages with no security disclosure process are a poor fit for regulated audit trails, key rotation policy, or SOC 2 evidence.
• CORS belongs at the edge. Per-token CORS is elegant, but if we already terminate at a CDN or load balancer, duplicating CORS logic in the app creates two sources of truth.
• Query-param token extraction is non-negotiable to disable. If the package cannot be configured to reject tokens in query strings, that is a blocker for anything touching sensitive data.
• We need long-term vendor accountability. No release cadence history, no stated support window, no upgrade guide. Treat v1.0.0 as the start of a track record, not a guarantee.

Recommended next step: time-boxed spike (1–2 days) covering quota concurrency behaviour, token storage hashing, and CLI ergonomics. Decision gate: promote to dependency, or replicate the token/quota layer internally on top of Sanctum.

How to Pitch It (Stakeholders)

To executives: An open-source (MIT) Laravel package, Nemesis v1.0.0, just reached its first stable release and covers the access-control plumbing for partner-facing APIs — scoped tokens, per-token CORS, usage quotas with automatic cut-off, and admin commands to create, reset, block, and list tokens. It lets us test a monetisable API surface in days rather than funding an internal build. The risk is maturity: one author, first stable version, no track record yet. Recommendation is a small, contained pilot with a pinned version, not a platform-wide commitment.

To engineering: Stable release, middleware auto-registered, Artisan commands for the full token lifecycle, optimised request counting, and token extraction from both the Authorization header and query params. Before we adopt: verify where quota counters are stored and how they behave with multiple app instances, confirm tokens are hashed at rest, check that query-param extraction can be disabled, and confirm the cleanup/uninstall path leaves no residue. It is not a replacement for Sanctum or Passport — position it as the token-scoping and quota layer, not the auth layer. Read the source before it goes anywhere near production traffic.

Ask: Approve a two-day spike and one pilot integration behind a feature flag, with a decision review at the end of the sprint.