- How do I install martin6363/laravel-api-auth in a Laravel 12 application?
- Run composer require martin6363/laravel-api-auth, then run php artisan api-auth:install. That command publishes config/api-auth.php, checks that Sanctum is present, and optionally runs migrations. Sanctum must already be installed and migrated if it is not, and your User model needs the HasApiTokens trait before the auth endpoints work. The flow is the standard Laravel package contract with no exotic infrastructure.
- Does laravel-api-auth support Laravel 11 and Laravel 12?
- Yes. The package requires PHP 8.2 or newer, Laravel 11.0 or 12.0 or newer, and Laravel Sanctum 4.0 or newer. It is not intended for Laravel 10 or earlier, and it assumes Sanctum is your token mechanism. Stacks built on Passport or an external identity provider such as Auth0, Cognito, or Keycloak are out of scope and should not try to adapt it.
- Can users log in with a username or a custom field instead of email?
- Yes, login uses dynamic identification, so the identifier can be email, username, or any custom column you configure. Because that column comes from configuration, verify in a spike that the lookup is parameterized and that request input cannot influence the column name. Also confirm failed-login responses are identical whether or not the account exists, so throttling does not leak account existence.
- Is the token refresh in this package real refresh-token rotation?
- The README advertises access tokens with refresh capability, but it does not document rotation, revocation of the previous token, or reuse detection. Check in a spike whether refresh revokes the old token or simply issues a new Sanctum personal access token, because the second behavior is materially weaker. If rotation is missing, plan to implement it yourself before depending on refresh in production.
- How do I configure rate limiting for login, registration, and password reset?
- Rate limiting is configurable in config/api-auth.php after you publish it with php artisan api-auth:install. Decide deliberately between per-IP, per-identifier, and combined strategies, and inspect whether throttled responses differ in a way that reveals which accounts exist. Test the limiter under load, since a wrong config key can silently weaken authentication rather than fail loudly.
- Does laravel-api-auth handle email verification, and can the notification be queued?
- Yes, email verification is built in and supports queueable, customizable notifications, so verification mail can go through your existing queue workers. Review the published services to see how verification tokens are generated, hashed at rest, and expired. If the package falls back on Laravel defaults, confirm that behavior is what you actually want before going live.
- How do I customize or override the package controllers and services?
- The install command publishes the configuration, and the package also lets you publish its controllers and services so you can extend or replace the default logic. That service-oriented layout is the intended extension point for custom flows and response formats. Publish and edit route registration rather than patching vendor files, so Composer updates stay clean.
- Does this package have tests and CI coverage for auth failure paths?
- The README describes the package as test ready but does not publish a coverage report or CI badge, so treat test quality as unverified. Ask the maintainer whether there are feature tests for failure paths, not just happy paths, covering invalid identifiers, expired reset tokens, throttled logins, and refresh revocation. If the answer is thin, write your own feature tests around every endpoint before adopting it.
- Is martin6363/laravel-api-auth safe to use in production?
- Treat that as an open question: the package has almost no adoption signal (one GitHub star, zero dependents), a single maintainer, no documented security disclosure process, and no CVE track record, while authentication is the highest-consequence code path in an API. The MIT license lets you fork and audit, but there is no community backstop if the maintainer disappears. Also verify the anomalous 2026-08-01 release timestamp and what actually changed in it. Get written answers on refresh semantics, reset-token expiry, and failure-path tests before shipping it to live users.
- How does this compare to Laravel Breeze, Fortify, or writing my own Sanctum auth?
- Breeze, Fortify, and Jetstream are session and starter-kit oriented, so teams building a JSON-only API often hand-roll registration, login, refresh, reset, and verification on top of Sanctum. This package targets exactly that gap with a configuration-driven scaffold, which can be cheaper to own than bespoke code if the security questions get answered. If you need a hardened, widely reviewed auth layer today, a maintained alternative or a small in-house implementation may be the safer call.