graham-campbell/credentials
A Laravel package by Graham Campbell for managing application credentials. It offers a simple, configurable way to store and retrieve sensitive values such as API keys, tokens, and passwords, helping keep them organized and out of your codebase. Integrates smoothly with Laravel's container and confi...
Bottom line: This is a reference design, not a dependency. Every source describes the same headline—Laravel credential handling—but three different implementations: a secrets vault (encrypted API keys/tokens with a HasCredentials trait), a custom auth guard (token-based login swapped into Illuminate\Auth), and OAuth/social login with a polymorphic identities table. Until one engineer reads composer.json, the service provider, the migration, and the config, the package has no costable scope. Resolving that ambiguity is the first gate; nothing else should be scheduled before it.
Architecture fit: Weak for anything current. It targets Laravel 5.x and PHP runtimes now past EOL, and it sits on an auth surface Laravel has since replaced with first-party Sanctum/Passport. If it is the vault, we likely already own the capability through the platform secrets manager plus Laravel's encrypted casts and config encryption—so the package duplicates a supported answer with none of the support. Either reading produces an unsupported island in the dependency graph, which means it can only be justified behind a legacy constraint.
Integration feasibility: Low and unproven. Manual service-provider registration (it predates auto-discovery), config publishing, migrations, and possible guard wiring all need verification. With zero stars, zero dependents, and no public install evidence, the TPM default should be that the happy path is broken until a spike proves otherwise.
Technical risk: High, concentrated in security, and it lands in an authentication or secrets path—the two places we can least afford an unmaintained dependency. Depending on which package it is, the exposure is either credential leakage from a homegrown encrypted store with an unreviewed driver, or auth bypass from misconfigured guards and weak token handling. Both are review findings waiting to happen, and with no adopter base nobody is finding those bugs before an attacker does.
Key questions a TPM must get answered before committing budget:
APP_KEY decrypt everything?Stack fit: Narrow by design. It is viable only inside an existing Laravel 5.x application that cannot move as part of this feature. For a new build or a Laravel 8+ estate, the correct answer is Socialite for social sign-in, Sanctum or Passport for API tokens, and the platform secrets manager for application credentials. Where a legacy constraint is real, isolate the package behind an internal AuthService or guard adapter so no application code references package classes directly—that adapter is the TPM's insurance policy, because it turns a one-way door into a swap.
Migration path: There is no clean upgrade route from this package to modern Laravel auth, so treat adoption as one-way with a pre-funded exit. Inventory every auth flow first—login, API tokens, password reset, remember-me, guard selection, user provisioning. Migrate credential rows with hashes preserved rather than re-hashed, and prefer dual-read or shadow validation with a tested fallback before cutover. Plan the eventual migration to Sanctum/Passport at the same time you plan the adoption; sequencing them together is far cheaper than sequencing them apart.
Compatibility: Validate Composer constraints against illuminate/auth, illuminate/database, and illuminate/support on the target PHP minor, and exercise service-provider boot, config publish, migrations, guard registration, middleware ordering, exception handling, and token verification in CI. Confirm column types and indexes on credential lookups, and scan for PHP 8 deprecations that will surface silently on a patch bump.
Sequencing: (1) Resolve the scope ambiguity and read the code—one engineer, one day. (2) License and security audit. (3) Time-boxed non-production spike on the real runtime. (4) Threat model and test matrix. (5) Fork, vendor-pin, build the adapter, migrate, then stage rollout with an explicit rollback. Do not make this the first dependency in any auth or secrets redesign.
Better path to the same outcome: Use the package's schema and flow as the spec, then build on first-party primitives. The user-facing result is identical and the dependency is defensible in a security review.
Maintenance: High and permanent. Zero dependents means zero free maintenance—the adopting team owns patching, dependency updates, security fixes, and framework/PHP compatibility indefinitely. EOL-framework packages rot quietly, so budget recurring cost even when the feature looks stable and untouched.
Support: Effectively none. Documentation is stale and self-contradictory, there is no vendor escalation, and public troubleshooting is negligible. We must write an internal runbook covering guard configuration, credential rotation, token revocation, secrets re-keying, incident response, and rollback. Security response is entirely ours, and that is the single largest ongoing cost in this assessment.
Scaling: Auth volume is modest relative to application traffic, but hashing is CPU-bound and credential lookups need proper indexes. Horizontal scale requires stateless tokens or shared storage; distributed revocation, rate limiting, and cache-aware guards will likely need to be built outside the package. If the vault reading holds, add cache-invalidation risk—a stale cache serving a rotated secret is a genuine, hard-to-detect failure mode.
Failure modes to monitor and alert on: auth bypass from misconfigured guards; token or plaintext-secret leakage; expired tokens still accepted; migration-induced user lockout; Composer conflicts blocking framework upgrades; service-provider boot failure; missing migrations after deploy; silent breakage after a PHP patch bump. Track auth failure rate, token validation errors, login latency, and credential-table growth.
Ramp-up: Moderate to high. Expect a security review, a compatibility spike, adapter work, a migration rehearsal, and runbook authoring before production—several weeks of senior engineering time for a package with no adoption signal. Against a 0.3 composite score and zero dependents, that cost is only justifiable if a legacy constraint forces adoption, and even then it should be framed as acquiring a codebase to own rather than installing a library.
TPM recommendation: Fund the capability, not the dependency. Resolve the documentation ambiguity immediately, extract the data model and flow as a design spec—getting the many-credentials-to-one-user shape right now is the expensive decision, not the package choice—and ship on Socialite/Sanctum/Passport with the platform secrets manager. If a Laravel 5 constraint is confirmed, fork and pin it as an internal component with a named owner, a completed security audit, and a deprecation date set on day one.
How can I help you explore Laravel packages today?