- How do I install arielmejiadev/json-api-auth in a Laravel application?
- Install it with Composer using composer require arielmejiadev/json-api-auth. The package targets Laravel applications, and version 1.1.0 adds Laravel 9 support, so confirm the declared illuminate/* and php constraints match your composer.json before installing. After installing, follow the repository README for any service provider registration, config publishing, or migration steps your version requires, then run your test suite before wiring it into production routes.
- Which Laravel versions does json-api-auth support?
- The 1.1.0 release widens framework compatibility to Laravel 9, which is the only concrete compatibility signal in that release. Because a framework-support bump often raises the minimum PHP version or drops older Laravel majors, verify the exact illuminate/* and php constraints in the package's composer.json rather than assuming. If your estate runs a mix of Laravel 8 and 9, the release is only adoptable on the Laravel 9 cohort unless the constraint is a disjunction such as ^8.0|^9.0.
- What endpoints does this package generate for JSON API authentication?
- It scaffolds token-based authentication with ready-made login, registration, refresh, and logout endpoints. That means you get the full access-token lifecycle without hand-writing controllers, request validation, and token issuing logic yourself. The goal is to let you secure API routes and issue access tokens quickly on a fresh or existing Laravel API.
- How is this different from Laravel Sanctum or Passport?
- Sanctum and Passport are first-party, heavily maintained Laravel packages with broad ecosystem support, SPA cookie authentication, and OAuth2 features respectively. This package is a lighter scaffold focused specifically on JSON API token authentication, with login, registration, refresh, and logout routes provided out of the box. If you need OAuth2 grants, scopes, or long-term first-party maintenance guarantees, evaluate Sanctum or Passport first; if you want a minimal drop-in auth scaffold, this is the narrower option.
- Is version 1.1.0 a breaking change if I extended the package's classes?
- The 1.1.0 release note mentions changing some internal methods alongside Laravel 9 support, and internal is the maintainer's designation rather than an enforced one in PHP. Any code that subclasses the package, overrides a method, binds a concrete class in the container, or mocks internals in tests can be silently broken by that refactor. Diff 1.0.x against 1.1.0, classify each changed method as private, protected, or public, and grep your codebase and tests for those symbols before upgrading.
- How do I configure the package after installation?
- Configuration typically lives in a published config file plus environment variables for token lifetimes and guard settings, but the exact keys depend on the version you install, so treat the README as authoritative. Check whether the package publishes a config file or migrations, and confirm which authentication guard and user provider your API routes should use. Keep secrets and token TTLs in environment variables so staging and production can diverge safely.
- How do I write feature tests for the login and registration endpoints?
- Use Laravel's HTTP testing helpers to post credentials to the login and registration routes and assert on the JSON structure of the token response, such as asserting the token key exists and is a non-empty string. Refresh the database between tests and create users through factories rather than seeding. If your tests mock or extend package internals, rerun them against 1.1.0 specifically, since the internal method changes in that release are the most likely source of silent test failures.
- How do I protect my API routes with the tokens this package issues?
- Apply Laravel's auth middleware, configured for the appropriate guard, to any route group that should require a valid access token. Keep login, registration, and refresh routes public, and put logout plus all business endpoints behind the protected group. Verify the guard configuration matches what the package expects so token resolution works, and cover both the authorized and unauthorized paths in feature tests.
- How should I handle token refresh and expiry in production?
- Use the provided refresh endpoint to exchange a valid refresh credential for a new access token, and keep access token lifetimes short so a leaked token has limited value. Invalidate refresh tokens on logout and store them with the same care as passwords, ideally hashed and revocable server-side. Monitor refresh failure rates after deployment, since clock skew and misconfigured TTLs are common causes of sudden 401 spikes.
- Is arielmejiadev/json-api-auth actively maintained, and how should I pin it?
- The 1.1.0 release shipped with a single-line note and no changelog, upgrade guide, or deprecation notice, which is a governance signal worth weighing for a package sitting in your auth path. Pin explicitly rather than loosely: use ^1.1 so a rebuild cannot silently resolve back to the pre-Laravel-9 line, and consider pinning the exact validated patch, 1.1.0, if your code overrides or mocks any internals. Roll it out as an independent, revertible change through staging before production, and review the repository and issue tracker for release cadence and response history.