- What does graham-campbell/credentials actually do?
- The package is described as a simple, configurable way to authenticate and manage application credentials in Laravel 5, including API keys, tokens, and passwords. However, the available sources describe three different possible implementations: an encrypted secrets vault with a HasCredentials trait, a token-based custom auth guard, and OAuth or social login with a polymorphic identities table. You must inspect composer.json, the service provider, migrations, and config to determine which one the package really is before adopting it.
- Which Laravel and PHP versions does graham-campbell/credentials support?
- The package targets Laravel 5.x and PHP runtimes that are now past end of life. It predates Laravel package auto-discovery, so manual service-provider registration is expected. Validate the declared Composer constraints against illuminate/auth, illuminate/database, and illuminate/support on any PHP minor you still support before planning an install.
- How do I install graham-campbell/credentials in Laravel?
- Installation starts with a Composer require, but you will likely need to manually register the service provider because the package predates auto-discovery. You should also expect to publish configuration and possibly run migrations or wire a guard. Treat the happy path as unproven until a short spike confirms provider boot, config publish, migrations, and any guard registration on your exact Laravel version.
- Is graham-campbell/credentials a credential vault or an auth guard?
- That is the core ambiguity with this package. One reading is a secrets vault that stores encrypted API keys and tokens behind a HasCredentials trait, while another is a custom token-based auth guard swapped into Illuminate Auth, and a third is OAuth or social login with an identities table. Do not schedule integration work until an engineer reads the source files and confirms the real scope and guard driver alias.
- Is graham-campbell/credentials safe to use in production?
- The technical risk is high because the package sits on either a secrets path or an authentication path, and it has zero stars, zero dependents, and no public install evidence. It is also unmaintained relative to modern Laravel auth, with no adopter base finding bugs before attackers do. Only consider it behind a hard legacy constraint, and isolate it behind an internal adapter so it can be replaced.
- What are better alternatives to graham-campbell/credentials for Laravel?
- For social sign-in, use Laravel Socialite; for API tokens, use Sanctum or Passport; and for application secrets, use your platform secrets manager plus Laravel encrypted casts and config encryption. These are first-party or supported answers that replace the auth surface this package targets. On a new build or a Laravel 8+ estate, none of the package's possible implementations justify adoption.
- Does graham-campbell/credentials replace Laravel's built-in authentication?
- It may augment or replace parts of Illuminate Auth depending on which implementation you have, for example by registering a custom token guard. The package does not map cleanly onto modern Laravel auth, which has since moved to Sanctum and Passport for token-based flows. Inspect the service provider and config to see whether it registers a guard driver, an auth provider, or only credential storage.
- How do I test graham-campbell/credentials before committing to it?
- Run a time-boxed spike that installs the package on a representative Laravel 5.x application and exercises service-provider boot, config publishing, migrations, guard wiring, login, token issuance, and credential retrieval. Check whether tokens are hashed, expiring, revocable, and scoped, and whether comparisons are timing-safe. Also review license, test coverage, last commit date, open advisories, and abandoned transitive dependencies.
- Can I use graham-campbell/credentials with Laravel 8, 9, 10, or 11?
- No, it targets Laravel 5.x and EOL PHP runtimes, so it is not a fit for modern Laravel applications. Laravel has replaced this auth surface with first-party Sanctum and Passport, and credential storage is better handled by encrypted casts, config encryption, or a secrets manager. Adoption only makes sense inside an existing Laravel 5.x app that cannot move as part of the feature.
- How do I migrate away from graham-campbell/credentials later?
- There is no clean upgrade route, so treat adoption as a one-way door with a pre-funded exit. Put the package behind an internal AuthService or guard adapter so no application code references package classes directly. Inventory login, API tokens, password reset, remember-me, guard selection, and user provisioning first, then migrate credential rows with hashes preserved and use dual-read or shadow validation before switching to Sanctum, Passport, or a secrets manager.