- Can I install ma27/api-key-authentication-bundle in a Laravel app?
- No. It is a Symfony bundle, not a Laravel package, and it has been archived since its last release on 2016-12-17. It has no Laravel service provider, facade, guard driver, middleware, or config stub, and installing it would likely pull old Symfony contracts into a modern Laravel dependency tree. The only defensible path is to read the source as a reference and reimplement the auth flow natively in Laravel.
- What does ma27/api-key-authentication-bundle do?
- It is a Symfony bundle that adds API key authentication to an application. You define keys in configuration and protect routes through a Symfony firewall listener, with support for custom extractors and user providers. It is a lightweight option for service-to-service or simple token-based access in Symfony, not Laravel.
- Is ma27/api-key-authentication-bundle still maintained?
- No. The package is archived, its last release was on 2016-12-17, it has 8 stars and 0 dependents, and it is not viable as a production dependency. Even on Symfony, the underlying security contracts were rewritten in 5.3 and removed in 6.0, so the bundle is unlikely to run on supported Symfony versions either. Treat it as a small historical reference implementation only.
- How do I build Laravel API key authentication without this package?
- Create a migration and Eloquent model for API keys, generate keys with random_bytes or Str::random, store only a SHA-256 hash, and verify with hash_equals for constant-time comparison. Register a custom guard through Auth::extend and protect routes with an auth.apikey middleware. A production-grade version should also include expiry, revocation, rotation, scopes or permissions, and last_used_at tracking.
- Does this bundle support Laravel guards or middleware?
- No. There is no Laravel guard driver, middleware, service provider, or configuration file in the repository. The bundle wires into Symfony's firewall and authentication provider system, which Laravel does not use. Any Laravel guard or middleware for API key auth must be built separately.
- What security issues should I check before porting API key auth from this bundle?
- Verify that key generation uses a CSPRNG such as random_bytes or openssl_random_pseudo_bytes, not uniqid, mt_rand, or time-seeded values. Confirm that keys are stored hashed rather than plaintext and that comparisons use hash_equals rather than == or ===. Also expect missing lifecycle features such as expiry, revocation, rotation, scopes, and last_used_at, which must be added as net-new work.
- What PHP and Symfony versions does ma27/api-key-authentication-bundle support?
- Because the last release was in 2016, its composer.json likely declares old PHP and Symfony version ranges and may exclude PHP 8.x outright. Check the declared constraints before any spike, because an incompatible PHP floor or ceiling can end the investigation immediately. Even on Symfony, later security contract changes make it unlikely to run on currently supported versions.
- Does the bundle support multiple API keys per user, expiry, revocation, or scopes?
- Based on its small 2016 design, expect single-key-per-user behavior and no modern lifecycle features. Verify the source during a spike, but plan for net-new work for multiple keys, expiry, revocation, rotation, scopes or permissions, and last_used_at tracking. Those features are table stakes for a real API-key system and are not solved by installing this bundle.
- Can I use this bundle as a reference implementation for Laravel API tokens?
- Yes, but only as a small reference implementation. The reusable surface is limited to an entity or model for key storage, a key generator, a verification routine, and a request-side authentication hook. Extract the algorithm and security lessons, then rebuild it with Laravel-native migrations, Eloquent models, Auth::extend guards, middleware, and tests.
- What are alternatives to ma27/api-key-authentication-bundle for Laravel API key auth?
- For Laravel, use Laravel Sanctum for first-party API tokens or Laravel Passport when you need full OAuth2. For service-to-service API keys, build a custom Laravel guard and middleware with hashed keys, constant-time verification, expiry, revocation, and scopes. The ma27 bundle is Symfony-only and archived, so it is not a practical alternative in a Laravel application.