- What is chrisbjr/api-guard used for in Laravel?
- chrisbjr/api-guard is a Laravel package for simple machine-to-machine API authentication using static API keys. It adds an Eloquent model and migration for an api_keys table, a route middleware, and a trait for generating and associating keys with users. It fits legacy Laravel 5.x apps that need lightweight token-based API access, not user-delegated OAuth flows.
- How do I install and configure chrisbjr/api-guard?
- Installation follows the typical Laravel 5.x pattern: require the package via Composer, register the service provider, publish the migration, and run it to create the api_keys table. Add the auth.api middleware alias and protect routes with it. On Laravel 8+ verify service provider discovery, middleware registration, and deprecated helpers before assuming it is drop-in.
- Does chrisbjr/api-guard work with Laravel 8, 9, 10, or 11?
- The package was built for Laravel 5.1 through 5.4 and last had a release in 2016. It likely needs changes for Laravel 6+ because of removed helpers such as str_random(), and middleware alias registration differs in newer skeletons. Treat Laravel 8+ compatibility as unproven and test or fork before using it.
- Is chrisbjr/api-guard secure for production API authentication?
- For production, the original package has significant gaps: it stores API keys in plaintext, uses an active boolean instead of expiry, and has no built-in rate limiting or audit trail. Keys passed in query strings can leak into logs and proxies. If you need compliance-grade credential handling, do not adopt it as-is; fork it to hash keys, enforce headers, add expiry, and throttle requests.
- How does chrisbjr/api-guard compare to Laravel Sanctum or Passport?
- Sanctum and Passport are first-party, actively maintained Laravel packages with hashed token storage, expiration, abilities, and migration guidance. api-guard is a thin, abandoned implementation for static shared secrets. Choose Sanctum for first-party SPA/API tokens, Passport for full OAuth2, and api-guard only for a contained legacy app or as a reference implementation.
- Can I use chrisbjr/api-guard to assign scopes or abilities to API keys?
- The package supports assigning abilities to API keys, but this is a simple static-credential model rather than delegated authorization. It does not provide OAuth scopes, token exchange, refresh tokens, or user consent. If you need scoped third-party access, use Sanctum abilities or Passport scopes instead.
- How are API keys stored and transmitted with chrisbjr/api-guard?
- In the original implementation, API keys are stored in plaintext in the api_keys table and validated per request via a header or query string. Query-string transmission (?api_key=) is risky because URLs leak into access logs, proxies, and browser history. Prefer header-only transmission and plan to hash keys at rest if you fork the package.
- Does chrisbjr/api-guard support key expiration, rotation, or revocation?
- The package relies on an active boolean rather than built-in expiration, rotation, or revocation workflows. You can deactivate a key or delete it, but there is no expires_at column or scheduled rotation support out of the box. If your requirements include rotation or expiry, add those columns and middleware logic or migrate to Sanctum.
- How do I test routes protected by the auth.api middleware?
- There is no test suite signal in the package, so you should write your own feature tests around routes protected by the auth.api middleware. Use Laravel's testing helpers to send requests with and without valid API keys and assert unauthorized and authorized responses. If you fork the package, add tests for key generation, storage, activation, and middleware behavior.
- What should I do if I already use chrisbjr/api-guard in a legacy Laravel app?
- For a legacy Laravel 5.x app, contain the risk: vendor or fork the package, pin the commit, hash keys at rest, add expires_at, enforce header-only transmission, and add rate limiting at the middleware or gateway. Then build a bridge middleware that accepts both old and new credentials and migrate clients on a coordinated schedule. For new projects, skip api-guard and adopt Sanctum instead.