Weave Code
Laravel Mongodb Passport Laravel Package
designmynight/laravel-mongodb-passport
Laravel MongoDB Passport lets you use Laravel Passport’s OAuth2 server with MongoDB, storing clients, tokens, and related Passport data in Mongo collections instead of a relational database. Ideal for Laravel apps already built on MongoDB.
A package to get Laravel Passport working with MongoDB
Frequently asked questions about Laravel Mongodb Passport
- Can I use Laravel Passport with MongoDB instead of a relational database?
- Yes, designmynight/laravel-mongodb-passport adapts Passport’s Eloquent models so clients, tokens, refresh tokens, auth codes, and personal access clients can be stored in MongoDB collections. It is intended for Laravel apps already standardized on MongoDB and committed to Laravel Passport. Keep in mind that OAuth state is security-sensitive and low-volume, so some teams still prefer to keep Passport tables in SQL even when application data lives in MongoDB.
- How do I install designmynight/laravel-mongodb-passport in a Laravel app?
- Install the package via Composer, configure your MongoDB connection, and wire Laravel Passport to the package’s MongoDB-backed models. You also need to run the package’s schema or index setup and validate all required grant types before production use. Exact wiring depends on your Laravel, Passport, and MongoDB driver versions, so check the README and test in a staging app first.
- Which Laravel, Passport, PHP, and MongoDB versions are supported?
- The package is an adapter around Laravel Passport internals and the MongoDB Laravel driver, so version alignment across PHP, Laravel, Passport, the MongoDB driver, and MongoDB server matters. The repository should publish a compatibility matrix and CI coverage, but you must verify those versions before adoption. If your Laravel or Passport major version is newer than the package’s tested range, treat the integration as unproven.
- Does it support authorization code, PKCE, password, client credentials, refresh tokens, and personal access tokens?
- The package is positioned to store Passport clients, tokens, refresh tokens, auth codes, and personal-access-client records in MongoDB. Coverage of every Passport feature, including PKCE, scopes, revocation, pruning, and introspection, depends on the package version and Passport internals. Validate each grant flow and token lifecycle you need with integration tests before relying on it.
- How should I configure MongoDB indexes and TTLs for Passport tokens?
- MongoDB does not enforce foreign keys, so orphaned clients and tokens are possible; unique indexes, token lookup indexes, expiry indexes, and TTL behavior must be designed and tested. Document which indexes the package expects and manage them through migrations or an explicit index setup step. Test token lookup, revocation, and pruning under realistic load and expiry conditions.
- Can I migrate existing Passport SQL tokens to MongoDB?
- Existing access and refresh tokens are opaque credentials and should generally be invalidated rather than migrated. Client records and personal-access-client records can be backfilled, but token issuance and validation must be revalidated after cutover. Brownfield migration is materially harder than greenfield adoption, so use a controlled token-invalidation and rollback plan.
- Is laravel-mongodb-passport safe for production OAuth?
- It can be viable for a greenfield Laravel service already standardized on MongoDB, provided you operate replica-set MongoDB and own backup, monitoring, index management, and secret handling. The low star count and reliance on Passport internals mean limited production exposure and possible lag behind upstream Passport changes. For business-critical OAuth, consider keeping Passport in a relational database unless MongoDB storage is a hard architectural mandate.
- What are the alternatives to using MongoDB for Laravel Passport storage?
- The main alternative is to keep Passport’s OAuth tables in a relational database such as MySQL or PostgreSQL while using MongoDB for application data. OAuth state is low-volume and security-sensitive, so a separate SQL store is often operationally simpler. A custom Passport model layer is another option but carries the same coupling and maintenance risks as this package.
- How do I test laravel-mongodb-passport integration?
- Build a CI test suite that covers every grant type and feature you use, including token issuance, refresh rotation, revocation, scopes, pruning, and personal access tokens. Run it against the exact PHP, Laravel, Passport, MongoDB driver, and MongoDB server versions you plan to deploy. Include tests for ObjectId versus string IDs in client IDs, user IDs, personal access clients, and token introspection paths.
- Who maintains laravel-mongodb-passport and what is the upgrade policy?
- The package is a small open-source project with limited adoption, so you should check the repository for maintainer activity, changelog, security disclosure path, and release history. Because Passport model behavior can change across major versions, plan to pin versions and verify upgrades. Adopting teams should be prepared to own fixes or forks if upstream changes break compatibility.
Weaver
How can I help you explore Laravel packages today?