Weave Code
Nova Passport Manager Laravel Package
genealabs/nova-passport-manager
A Laravel Nova tool for managing Laravel Passport OAuth clients and access tokens. Create, edit, and revoke clients and personal access tokens directly from your Nova dashboard, without leaving the admin panel.
A Laravel Nova tool.
Frequently asked questions about Nova Passport Manager
- What is genealabs/nova-passport-manager used for?
- It is a Laravel Nova tool for administering Laravel Passport OAuth clients and personal access tokens. It gives operators Nova screens to create, edit, and revoke clients, browse tokens, and copy client IDs and secrets. It is admin-plane convenience tooling, not authentication infrastructure, and requires Laravel, Nova, and Passport.
- How do I install and register genealabs/nova-passport-manager in Laravel Nova?
- Install it with Composer, then register the tool in your NovaServiceProvider::tools() method and clear caches. The mechanical setup is simple, but you must already have a working Laravel app with a paid Nova license and Laravel Passport configured. Treat successful registration and rendering on your pinned versions as something to verify in a spike.
- Which Laravel, Nova, and Passport versions does genealabs/nova-passport-manager support?
- There is no published compatibility matrix beyond release 0.9.0, which added Laravel 11 via a community contribution. Nova 4 and 5 support and current Passport majors are not evidenced, and the package has very little downstream usage to infer from. Pin versions and prove the install and screens on your stack before relying on it.
- Does genealabs/nova-passport-manager work with Laravel 11 and Nova 4 or Nova 5?
- Release 0.9.0 added Laravel 11, but that does not prove Nova 4 or Nova 5 compatibility. The only compatibility evidence is that single release, so the Nova major and Passport major you use remain unproven. Run a timeboxed spike that installs, registers, and exercises the screens on your exact pins.
- Can I create, edit, and revoke Passport clients and personal access tokens from Nova with this package?
- Yes, the tool provides Nova resource screens over Passport's oauth_clients and oauth_access_tokens records. Operators can create and edit clients with grant types and redirect URIs, browse and revoke personal access tokens, and copy client IDs and secrets. It covers OAuth administration CRUD, not approvals, scope governance, audit trails, multi-tenancy, or partner self-service.
- How does genealabs/nova-passport-manager behave when Passport::hashClientSecrets() is enabled?
- If Passport::hashClientSecrets() is enabled, client secrets are stored hashed and cannot be re-displayed. A UI that assumes a retrievable secret will either show nothing useful or mislead an operator into thinking a rotation succeeded. Verify the behavior before enabling hashing and build your rotation runbook around it.
- Does genealabs/nova-passport-manager include authorization or Nova policies to protect OAuth screens?
- Do not assume adequate authorization ships with the package. Gate tool registration with Gate::check and add Nova policies so that a Nova user who is not an OAuth administrator cannot reach these screens. Authorization for this credential surface remains your responsibility.
- Is genealabs/nova-passport-manager maintained and safe for production use?
- It is archived with a single maintainer, 25 stars, and zero dependents, so expect no compatibility fixes, security response, or triage. That is high risk for code that reads client secrets and access tokens and is not acceptable without an internal owner. If you adopt it, treat it as a fork candidate with pinned versions and tests.
- Does revoking a token or deleting a client invalidate issued tokens, and is there an audit trail?
- The package manages Passport records, but you must confirm in your Passport version that revocation actually invalidates issued tokens server-side and that deleting a client invalidates its tokens. It does not provide an audit trail, so every mutation is unattributed unless you add logging. That matters for incident review after a leaked token is revoked.
- What alternatives to genealabs/nova-passport-manager should I evaluate?
- Evaluate a small custom Nova implementation over the two Passport resources, a maintained alternative, or a Blade/Livewire or artisan-command runbook if you do not already use Nova. If you only need first-party token auth, Sanctum removes this problem class. Before adopting, spike install and rendering, CRUD and revocation, hashed-secret behavior, custom client models, authorization gates, and audit logging.
Weaver
How can I help you explore Laravel packages today?