- What is juststeveking/laravel-bastion used for?
- Bastion targets long-lived bearer credentials for machine-to-machine and partner-facing APIs, using Stripe-style semantics: environment-scoped keys, per-key scopes, and revocation. It fits when the credential subject is an organization, integration, or service rather than an end user, and when your product needs a test/live separation story external developers already understand. Be aware the supplied documentation is self-contradictory, with the repository positioning describing API token authentication and the packaged description referencing invitation-based onboarding, so confirm which capability the released code actually delivers against repository HEAD.
- How is laravel-bastion different from Sanctum and Passport?
- Sanctum handles first-party SPA and session tokens, while Passport implements full OAuth2 grants and refresh flows. Bastion occupies the gap between them: static, long-lived API keys with granular scopes and environment separation. It is not a fit for consumer login, social sign-on, enterprise SSO, or delegated authorization, so do not adopt it expecting OAuth2.
- How do I install laravel-bastion in a Laravel app?
- The install surface is conventional: composer require the package, publish the config and migrations, add the provided trait to your authenticatable model, register the middleware alias, then attach that middleware to route groups with scope arguments. A Laravel engineer familiar with Sanctum can complete a working spike in under a day. The expensive part is what the package deliberately leaves to you: key lifecycle policy, scope taxonomy, environment mapping, and the customer-facing issuance experience.
- Which Laravel and PHP versions does laravel-bastion support?
- The best fit is a Laravel 10, 11, or 12 API-first or API-plus-SPA application, but you should verify PHP and Laravel constraints against your actual runtime before committing. The reviewed material does not document a clear semver commitment, and the version line is still early. Check composer.json on the repository for the authoritative support matrix.
- How does environment isolation between test and live keys work in Bastion?
- Bastion is designed around Stripe-style test and live key separation so external developers can integrate safely against a sandbox. The critical question is whether isolation is enforced inside the guard or middleware or only applied at mint time by convention, because a test key accepted in live is a customer-trust incident. Prove enforcement in source with an explicit negative test rather than inferring it from the marketing copy.
- How do scopes work in laravel-bastion?
- Keys carry granular scopes, and the middleware accepts scope arguments when attached to route groups. Before you rely on this, verify that scopes actually gate requests inside the middleware rather than being inert metadata your application must check itself. If they turn out to be inert, treat scope enforcement as application-layer work you own and budget for it.
- Are Bastion API tokens stored hashed?
- This is an open verification item rather than a documented guarantee, so confirm it against source before adopting. You want tokens stored hashed and looked up via a prefix index or constant-time comparison, not a full table scan plus comparison. The answer materially affects whether the package clears your security bar.
- Is juststeveking/laravel-bastion production ready?
- Ecosystem validation is thin: roughly 109 GitHub stars, zero dependents, a 0.0.2 release line, and a single maintainer, though there is a recent release from October 2025. That reflects limited demonstrated production usage and audit history rather than code quality, but it shifts assurance work onto your team. Mitigating factors are real: the MIT license, a recognized Laravel community maintainer, and a codebase small enough to vendor or fork within days.
- Can laravel-bastion run alongside Sanctum or Passport?
- Running Bastion alongside your existing guards is the expected architecture, since it authenticates services and integrations rather than humans. You still need to confirm the guards coexist without collision and that both can run in parallel on different route groups. Operating a second authentication system is a genuine architectural cost, so justify it with a real API or partner roadmap rather than convenience.
- Does laravel-bastion support key rotation and revocation?
- Revocation is part of the advertised Stripe-style semantics, so revoking a compromised key should be straightforward. Whether rotation supports an overlap or grace window, or only hard revocation, is an open question you must verify in source. If there is no grace window, plan and operate the rotation workflow yourself before issuing keys to external customers.