- How do I install corbosman/laravel-passport-claims in a Laravel app?
- Install the package with Composer using composer require corbosman/laravel-passport-claims. In modern Laravel versions, package discovery should register the service provider, but confirm this in your application version. The package blurb says no configuration file is required.
- How do I add custom claims to Laravel Passport access tokens with this package?
- Add the provided trait to your User model and implement a getExtraClaims() method. The returned data is embedded in the JWT when Passport issues an access token. Clients can then read those custom claims directly from the token payload.
- Which Laravel and Passport versions does this package support?
- This package is a thin extension to Laravel Passport, so support depends on Passport’s extension points in your installed version. The available context does not list exact Laravel, Passport, or PHP version constraints. Run a short compatibility spike and pin versions before using it in production.
- What kind of data can I put in getExtraClaims()?
- getExtraClaims() should return an array of custom claim names and values that are safe to embed in a JWT. Use namespaced claim names to avoid collisions with registered JWT claims such as iss, sub, aud, exp, and iat. Keep values compact and never include secrets because JWT payloads are readable by clients.
- Do the custom claims apply to refresh tokens, personal access tokens, and client credentials?
- The package overview focuses on Laravel Passport access tokens and the User-model trait. It does not explicitly document behavior for refresh tokens, personal access tokens, or client credentials. Test each token type and auth guard in your application before relying on claims there.
- Will adding custom claims break existing Passport tokens or clients?
- Introduce claims additively so existing tokens remain valid while consumers are updated. Make downstream services tolerate missing claims before you enforce claim-based authorization. Roll out behind a feature flag and canary by client or environment.
- How do I avoid JWT claim collisions and oversized tokens?
- Namespace custom claims, for example with a company or application prefix, and do not redefine standard JWT claims. Keep claim values small and cache resolver data if claims are computed from databases or remote services. Monitor token size against API gateway and HTTP header limits.
- What happens if getExtraClaims() throws an exception or returns stale data?
- A claim resolver exception can block token issuance because claims are resolved during token creation. Missing or stale claims can cause downstream authorization failures. Add timeouts and safe fallbacks, validate claims, and monitor issuance for failures.
- How should I test Laravel Passport JWT custom claims in CI?
- Add a contract test that issues a token for a test user and decodes the JWT payload. Assert that the expected custom claims are present and that standard claims are unchanged. Run the test against the exact Laravel, Passport, PHP, and JWT library versions used in production.
- Is corbosman/laravel-passport-claims actively maintained, and what are the alternatives?
- The package is niche and likely single-maintainer, so pin versions and monitor upstream activity. Keep a vendor or fork contingency and assign internal ownership for the claim schema and upgrades. Alternatives include implementing custom claims through Passport’s own extension points or choosing a more actively maintained package if your requirements grow.