Api Auth Bundle Laravel Package

Product Decisions This Supports

• API-First Roadmap: Accelerates development of secure, scalable API endpoints for B2B, B2C, or internal tools (e.g., mobile apps, IoT devices, or third-party integrations).
• Build vs. Buy: Avoids reinventing authentication wheels; reduces dev time by 30–50% compared to custom OAuth2/JWT implementations.
• Multi-Tenant SaaS: Enables per-tenant API keys with TTL (e.g., time-limited access for partners or contractors).
• Legacy System Modernization: Simplifies adding API auth to existing Symfony apps without major refactoring.
• Compliance & Security: Supports symmetric JWT (no SSH key management overhead) and custom claims for audit trails or role-based access.
• Developer Experience: CLI tools for key management reduce operational friction (e.g., php bin/console damax:api-key:create).

When to Consider This Package

• Adopt if:

  • Your stack is Symfony + Laravel-compatible (or you’re open to PHP).
  • You need both API keys (for simplicity) and JWT (for stateless auth) in one bundle.
  • Your use case requires flexible storage (Redis, DB, or config) for API keys.
  • You prioritize quick iteration over enterprise-grade OAuth2 (e.g., no need for PKCE, PKI, or complex token revocation).
  • Your team lacks dedicated security expertise but needs production-ready auth.

• Look elsewhere if:

  • You require OAuth2/OIDC (e.g., social logins, delegated auth).
  • Your API must integrate with identity providers (Okta, Auth0, etc.).
  • You need fine-grained token revocation (this bundle lacks built-in token blacklisting).
  • Your project is highly regulated (e.g., healthcare/HIPAA) and demands audit logs or hardware-backed keys.
  • You’re not using Symfony (though Laravel users could adapt the logic).

How to Pitch It (Stakeholders)

For Executives:

"This bundle lets us ship secure API access in weeks, not months. For example:

• Partners: Issue time-limited API keys (TTL) for sandbox testing without manual DB entries.
• Internal Tools: Replace basic auth with JWT for our mobile app, cutting support tickets by 40%.
• Cost Savings: Avoids $20K/year on third-party auth services like Auth0 for simple use cases. It’s like adding a ‘Login’ button to your API—except it’s for machines, not users."

For Engineering:

"Key benefits:

• Dual Auth Modes: Use API keys for scripts/CLI tools and JWT for mobile/web apps—no context switching.
• Storage Agnostic: Plug into Redis (low-latency) or your DB (ACID compliance) without rewriting logic.
• Extensible: Override ApiKeyUserProvider to bolt on custom logic (e.g., IP whitelisting, rate limiting).
• DevOps Friendly: CLI commands to manage keys (create, revoke, list) fit into CI/CD pipelines. Downside: No built-in token revocation, but we can add Redis pub/sub for a lightweight solution."*

For Security Teams:

"This meets our baseline for:

• Stateless JWT: Symmetric signing (HMAC) reduces key management overhead vs. RSA.
• Defense in Depth: Chain key extractors (header > query > cookie) to block injection attacks.
• Audit Trails: Custom claims let us log API usage by key/tenant without modifying the bundle. Gaps to address: We’ll need to implement token blacklisting via Redis (or a future PR)."*