Lighthouse Graphql Passport Auth Laravel Package

Product Decisions This Supports

• Authentication strategy for GraphQL APIs: Informs build-vs-buy decisions on auth for Laravel + Lighthouse-php GraphQL backends, where this package wires Laravel Passport (OAuth2) into GraphQL mutations (login, refresh, logout, register) instead of hand-rolling token issuance.
• Mobile/SPA client roadmap: Password-grant and refresh-token flows exposed as GraphQL mutations directly support first-party mobile apps and SPA clients that need token-based sessions, an input to client-platform planning.
• Platform upgrade sequencing: v11.0.0 adds Passport 13 support. This is a signal for roadmap planning of the auth dependency chain (Laravel version → Passport version → this package), and constrains when the team can adopt newer Laravel releases.
• Scope containment: Adopting this package lets the team defer custom auth schema work (token lifecycle, guards, refresh semantics) and spend that capacity on core product features.
• Risk/roadmap input: A major version bump with a single dependency-support change tells you the maintainer tracks upstream Passport releases; useful when weighing bus-factor and long-term maintenance risk for a security-critical surface.

When to Consider This Package

Good fit when:

• You are running Laravel with Lighthouse-php and need OAuth2/password-grant auth exposed as GraphQL mutations with minimal custom code.
• You are on (or planning) Passport 13 / the matching Laravel version — this is now effectively the supported baseline for v11.
• Your clients are first-party (own mobile app, own SPA) where the password grant is acceptable; you are not building third-party OAuth2 provider flows.
• You want the auth surface to stay inside the GraphQL schema rather than mixing REST token endpoints into a GraphQL product.

Look elsewhere when:

• You are pinned to Passport 12 or older, or an older Laravel version — v11.0.0 is a major bump and likely drops the previous support matrix. Staying on 10.0.x is possible but you inherit an unmaintained-by-default track.
• You need OIDC, social login, MFA, or authorization-code + PKCE flows — this package is narrow and you would be layering significantly on top.
• You are not using Lighthouse-php or are not committed to Passport; Sanctum or a dedicated identity provider (Auth0, Cognito, Keycloak) may be a better buy.
• You require vendor-backed SLAs or audited security maintenance for auth — this is a small-maintainer open-source package on a security-sensitive path.

How to Pitch It (Stakeholders)

To executives: This is a small, focused open-source package that handles user login and token refresh for our GraphQL API, so we do not build and maintain that logic ourselves. The new 11.0.0 release keeps it compatible with the current generation of Laravel's authentication library. It is low-cost to adopt but carries single-maintainer risk on a security-relevant component; we should adopt it to save engineering time while keeping a documented exit path.

To engineering: v11.0.0 is a major version whose substantive change is Passport 13 support — treat it as a compatibility bump, not a feature release. Expect the prior Passport/Laravel support matrix to be dropped. Before upgrading, confirm our Laravel and Passport versions, run the full auth flow suite (login, refresh, logout, token expiry), and check the changelog for the 10.x → 11.x upgrade notes. If we are not yet on Passport 13, pin to 10.0.4 and schedule the upgrade with the platform bump rather than adopting it ad hoc.