Weave Code
Laravel Keyable Laravel Package
givebutter/laravel-keyable
Givebutter's Laravel Keyable brings simple, secure API key authentication to Laravel apps. Add the HasApiKeys trait to any model, generate and hash keys, protect routes with middleware, and manage multiple keys per user with straightforward revocation and expiration.
Add API keys to your Laravel models.
Frequently asked questions about Laravel Keyable
- How do I install givebutter/laravel-keyable in a Laravel application?
- Install it with Composer using composer require givebutter/laravel-keyable, then follow the package README for any configuration or migration steps. Add the HasApiKeys trait to each Eloquent model that should issue API keys. Run your test suite after installation to confirm the package constraints match your Laravel and PHP versions.
- How do I add API keys to a Laravel Eloquent model?
- Use the HasApiKeys trait on the model that should own keys, such as a User or Tenant model. The trait provides the relationship and key-generation behavior needed to create, authenticate, revoke, and expire keys. Keep key creation in trusted server-side code and never expose hashed key values to clients.
- Are API keys stored hashed in the database?
- Yes. Laravel Keyable is designed to generate and hash API keys, so the database stores hashed values rather than reusable plaintext secrets. Treat the plaintext key as a secret that is shown only at creation time. If you need to display keys later, use a rotation flow instead of storing plaintext.
- How do I protect Laravel routes with API key middleware?
- Register or attach the package middleware to the routes or route groups that require API key authentication. The middleware validates the incoming key and resolves the associated keyable model. Confirm the exact middleware alias and guard behavior in the package source before relying on it in production.
- Can one user or model have multiple API keys?
- Yes. The package supports multiple keys per model, which is useful for separate integrations, devices, or environments. You can revoke individual keys and apply expiration per key. This keeps blast radius smaller than sharing one long-lived key.
- How do I revoke or expire an API key?
- Laravel Keyable includes revocation and expiration support for keys owned by a model. Use the package methods and key records to revoke a specific key or set an expiration timestamp. Test revocation in staging so cached authentication or long-lived clients do not continue using stale keys.
- Does laravel-keyable replace Laravel Sanctum or Passport?
- No. Laravel Keyable is focused on API keys bound to Eloquent models, while Sanctum and Passport provide broader token, SPA, and OAuth-style authentication. It can coexist with them, but avoid overlapping authentication paths for the same routes. Choose one primary mechanism per API surface.
- What is the KeyableAuthenticated event in v3.1.1?
- KeyableAuthenticated is an additive event introduced in v3.1.1 for audit logging, usage telemetry, and downstream policy reactions after API key authentication. Register a listener to emit security or product events without changing the core authentication path. Confirm the event payload and firing semantics against the package source before depending on specific fields.
- Is givebutter/laravel-keyable safe for production and high-volume APIs?
- The v3.1.1 release is assessed as low risk and additive, with no expected schema changes. The main production concern is listener-side overhead: synchronous listeners that throw or perform heavy I/O can affect authentication. Keep listeners lightweight, queue non-critical work, wrap risky logic in try/catch, and monitor latency and error rates.
- Which Laravel and PHP versions does givebutter/laravel-keyable support?
- The package is Laravel-native, but exact Laravel and PHP constraints should be checked in its composer.json and README before upgrading. The v3.1.1 patch is described as a low-friction, backward-compatible upgrade. Verify compatibility in a non-production environment and run your existing test suite before production rollout.
Weaver
How can I help you explore Laravel packages today?