- How do I install overtrue/laravel-passport-cache-client in a Laravel app?
- Run composer require overtrue/laravel-passport-cache-client and let Laravel's package discovery register the service provider. If you need to tune the cache store, TTL, or key prefix, publish the config file with php artisan vendor:publish and adjust it. Passport must already be installed and working, since this package is an optimization layer rather than a replacement. After registering, confirm the cached client repository is bound in place of Passport's default.
- Which Laravel and Passport versions does this package support?
- Check the composer.json require constraints on the tagged release before you commit, because Passport has reshaped its container bindings and repository interfaces across the 10, 11, and 12 majors. The decorator must satisfy whatever contract your installed Passport version expects, so verify the constraint explicitly includes your target major rather than assuming compatibility. Pin the package version in composer.json and run your OAuth test suite against the exact combination you deploy.
- Do I need to change my authorization flow to use this package?
- No. It plugs in transparently as a drop-in replacement for Passport's client repository, so grant types, routes, and token responses stay exactly the same. Existing password, client_credentials, and refresh token flows keep working without modification. The only change is that client lookups during token and authorization requests are served from your configured cache store instead of hitting the oauth_clients table.
- Does caching OAuth clients actually make the /oauth/token endpoint faster?
- Yes, when client lookups are a meaningful share of the request cost. Passport resolves the client on every token request, which turns a single table into a read-amplification point under high traffic, especially with client_credentials grants or heavy password and refresh grant volume. Serving that row from Redis removes the query and the associated connection overhead. Measure before and after with your real traffic; if your bottleneck is password hashing or token signing rather than the client lookup, the gain will be small.
- Which cache store should I use with this package?
- Use a shared, distributed store such as Redis or Memcached. The database cache driver just relocates the query rather than removing it, and the array driver is per-request, so it delivers essentially no benefit under php-fpm. Configure a dedicated cache store and key prefix instead of reusing the default application cache, so unrelated workloads do not evict your client entries and keys do not collide across environments.
- How do I clear the cache when a client secret is rotated or a client is deleted?
- Stale credentials are the most common failure mode for this class of package: a rotated secret, revoked client, or changed redirect URI will keep being served until the TTL expires unless you invalidate explicitly. Wire client created, updated, and deleted model events to a cache forget call, and keep a short TTL as a backstop. Test the rotation path in staging before enabling the cache in production.
- Can I configure the TTL and cache key namespace?
- Yes, TTL and cache store are configurable through the published config file, so you can balance freshness against query reduction. Set a distinct key prefix per environment and per tenant, since cross-environment key collisions are a realistic failure mode when several applications share one Redis instance. Shorter TTLs narrow the stale-credential window at the cost of more database reads.
- Is it safe to run a low-star community package on the OAuth token path?
- The touch surface is small, roughly one decorator class and one service provider binding, so you can review it line by line before adopting it. The real risk is maintenance and release opacity: recent tags have shipped with only a compare link and no substantive changelog, so read the actual diff between versions rather than trusting the patch number. Pin the version, watch for Passport major upgrades that could break the binding, and keep a rollback path.
- Does this package cache access tokens and scopes, or only clients?
- The mechanism is a decorator around Passport's ClientRepository, so what it removes from the hot path is the repeated client lookup performed on each token request. Client records such as secrets, grant types, and redirect URIs are what get served from cache. It does not change how Passport issues, stores, or validates access tokens, and it is not a substitute for token storage or revocation handling.
- What are the alternatives to caching Passport clients?
- You can leave Passport's default repository in place and tune the database instead: a properly indexed oauth_clients table with a small working set often stays in the buffer pool and costs little. Moving token issuance to a centralized identity provider removes the lookup entirely, though that is a much larger architectural change. For simpler cases, a short-lived application-level cache around the client model, or a read replica for the clients table, gets you most of the benefit.