Weave Code
Passport Laravel Package
laravel/passport
Laravel Passport provides a full OAuth2 server for Laravel, enabling API authentication with access tokens, personal access tokens, and client credentials. Includes token issuing, revocation, and scope support with first-party integration.
Laravel Passport provides OAuth2 server support to Laravel.
Frequently asked questions about Passport
- How do I install Laravel Passport in a Laravel 10+ project?
- Run `composer require laravel/passport`, then publish the migrations and config with `php artisan passport:install`. Finally, add `Passport::routes()` to your `AuthServiceProvider` and run the migrations. Ensure your user model uses `OAuthenticatable`.
- Does Laravel Passport support personal access tokens for API clients?
- Yes, Passport includes personal access tokens out of the box. They’re ideal for server-to-server or trusted client authentication. Generate them via `Auth::login()` or the `passport:client` command, and they bypass OAuth2 flows entirely.
- Can I use Passport with Laravel Sanctum for hybrid authentication?
- No, Passport and Sanctum serve different purposes—Passport is for OAuth2 (external clients), while Sanctum is for API token auth (internal clients). However, you can use both in the same app if you need OAuth2 for third-party apps and Sanctum for lightweight API access.
- What Laravel versions does Passport v13.x support, and how do I upgrade?
- Passport v13.x supports Laravel 10+ and requires PHP 8.2+. To upgrade, check the [changelog](https://github.com/laravel/passport/blob/main/CHANGELOG.md) for breaking changes (e.g., UUIDs for clients in v13), then run `composer update laravel/passport` and test thoroughly.
- How do I secure Passport client credentials in production?
- Always hash client secrets using `Passport::hashClientSecrets()` during installation. Never store plaintext secrets in environment files or logs. Use `passport:keys --force` to rotate secrets in production, and restrict client credentials to trusted environments.
- Can I customize token claims or add custom scopes in Passport?
- Yes, extend the `Passport::tokensCan()` method to define custom scopes. For custom claims, override the `getClaims()` method in your `Token` model or use middleware to inject additional data into the JWT payload.
- Why is my Passport token revocation slow in production?
- By default, Passport marks tokens as revoked in the database, which can slow down queries under heavy load. Mitigate this by enabling soft deletes or caching revoked tokens in Redis. Alternatively, use `Passport::useTokenModel()` to switch to a more performant storage backend.
- How do I implement PKCE for SPA or mobile app authentication?
- PKCE is enabled by default in Passport for Authorization Code grants. Ensure your SPA/mobile app includes the `code_challenge` and `code_challenge_method` in the OAuth2 request. Passport handles validation automatically, so no additional configuration is needed beyond standard OAuth2 flows.
- Does Passport work with Laravel’s first-party authentication (Breeze/Jetstream)?
- Yes, Passport integrates seamlessly with Laravel Breeze/Jetstream. The `OAuthenticatable` trait is already included in Jetstream’s user model, and you can use Passport’s personal access tokens alongside Breeze’s session auth for a hybrid approach.
- What are the best alternatives to Passport for Laravel OAuth2 needs?
- For simpler needs, consider Laravel Sanctum (API tokens only) or Spatie’s Laravel OAuth Server (more granular control). For enterprise-grade OAuth2, evaluate LEAP Security’s packages or custom implementations using `league/oauth2-server`. Passport is ideal for most Laravel use cases due to its tight integration.
Weaver
How can I help you explore Laravel packages today?