kristories/novassport
Nova Passport is a Laravel Nova tool for managing Laravel Passport OAuth clients and access tokens directly from your Nova dashboard. Create, edit, and revoke clients and tokens without leaving the admin panel, simplifying API authentication administration.
Prerequisites (verify these first — the package does not install Passport for you):
/nova reachable).php artisan passport:installHasApiTokens trait on your User modelPassport::routes() in AuthServiceProvider'driver' => 'passport' on your api guard in config/auth.phpoauth_clients and oauth_access_tokens tables exist and are reachable via Passport's default models.Install:
composer require kristories/novassport
The package has no migrations of its own — it is a UI over Passport's existing tables. If it ships assets, publish them with the Nova asset pipeline (php artisan nova:publish or vendor:publish --tag=nova-assets).
Register the tool in app/Providers/NovaServiceProvider.php:
public function tools()
{
return [
new \Kristories\NovaPassport\NovaPassport,
];
}
(Check the package README for the exact tool class name for your version — some releases auto-register the Client/Token resources from the service provider, in which case you only add the menu tool.)
Where to look first:
oauth_clients rows.oauth_access_tokens for your users.First use case: create a password-grant or personal-access client for a mobile app or partner integration from the Nova UI instead of SSH-ing into production to run php artisan passport:client --password. Copy the client ID/secret immediately (see the hashing gotcha below), hand it to the integration owner, then later use the same screen to revoke it when the integration is retired.
Ops runbook for client lifecycle. Treat the Nova screen as the canonical place to create, inspect, and revoke OAuth clients. Document a checklist: create client → copy secret to the secret manager → verify a token request → record owner in the client name → revoke (not delete) at decommission.
Gate the tool to an admin role. Nova tools are visible to every Nova user by default. Conditionally register instead of exposing it:
public function tools()
{
return array_filter([
Gate::allows('manage-api-clients') ? new \Kristories\NovaPassport\NovaPassport : null,
]);
}
Define the gate in AuthServiceProvider so it flows through policies.
Pair with artisan for reproducibility. The UI is for human-in-the-loop operations. If you need deterministic clients in CI/seeders, keep using php artisan passport:client or Passport::client()->forceFill(...) in a seeder. Don't rely on the tool for infrastructure-as-code.
Issuing personal access tokens to end users. Passport hashes access tokens at rest, so Nova can never reveal a token value after creation — only metadata. If end users need tokens, wire a Nova action (or a small custom tool) on the User resource that calls $user->createToken($name, $scopes), flashes the plaintext once, and lets the NovaPassport token resource handle listing/revocation afterward.
Auditing with lenses. Add a Nova lens over the Tokens resource to surface revoked tokens, expired tokens, or tokens with no last_used_at in 90 days. Same for clients: filter revoked = true or missing scopes. This turns the raw list into something support can act on.
Bulk revocation via actions. Add a Nova action on the Client resource that revokes the client and its tokens in one transaction, rather than relying on the operator to do two steps.
Scopes. Define Passport::tokensCan([...]) in AuthServiceProvider. The package predates broad scope-editing UIs; if you rely on scopes, add a custom field or a post-create hook so clients are assigned scopes deterministically rather than through ad-hoc artisan calls.
Extend rather than fork. If you need extra columns, copy the package's Client/Token resource into app/Nova and adjust the fields. If the package auto-registers its own resources, register your subclass in NovaServiceProvider::resources() and remove/override the package entries; otherwise you'll get duplicate menu entries.
Passport::hashClientSecrets() (in AuthServiceProvider::boot) hashes client secrets in oauth_clients.secret. With that enabled, the Nova detail view will show a hash, not a usable secret. Decide deliberately: either copy the secret on creation or don't enable hashing — but understand the trade-off.oauth_access_tokens stores hashes. The Tokens resource is for listing, auditing, and revoking — not for retrieving bearer tokens. Don't file a bug expecting to see the plaintext.client_id joins. Revoking the client stops new issuance; also revoke its tokens if the integration is compromised.grant_types column and shifted away from the personal_access_client / password_client boolean columns in some paths. A 2022 package may not read or write grant_types, so newly created clients can behave unexpectedly in token flows. Test against the exact Passport version in your lockfile before rollout.composer.json before upgrading Nova; a broken tool can take down the whole Nova dashboard for admins.php artisan optimize:clear and php artisan nova:publish. Tools with compiled assets often need the asset publish step; a 404 on the tool JS is the usual symptom.Laravel\Passport\Client and Laravel\Passport\Token directly. If you've overridden Passport::useClientModel() or renamed tables, the Nova screens will be empty or throw — override the resources in app/Nova in that case.oauth_access_tokens without aggressive filtering; on a busy API this table is large. Set public $perPage and add index coverage on user_id and revoked, or the index page will crawl.passport:client, passport:client --revoke) documented as the fallback so you can drop the package without losing capability.How can I help you explore Laravel packages today?