- How do I install overtrue/laravel-qcloud-federation-token in a Laravel app?
- Install it with Composer using composer require overtrue/laravel-qcloud-federation-token. Laravel package discovery registers the service provider and facade automatically, so no manual registration is normally needed. After installing, publish the configuration file and add your Tencent Cloud credentials to your environment.
- How do I configure the Tencent Cloud SecretId, SecretKey, region, and endpoint?
- The package exposes SecretId, SecretKey, region, and endpoint through a publishable configuration file, so you should keep the actual values in environment variables rather than committed config. Publish the config first, then set per-environment values for local, staging, and production. The wrapper passes those settings to Tencent Cloud STS when requesting a token.
- How do I generate a Tencent Cloud federation token with a custom policy and expiry?
- Call the package through its facade or injected service and pass the policy and token lifetime you need. The package wraps the QCloud STS federation-token flow, so the policy you supply determines the scope of the temporary credentials and the expiry controls how long they remain valid. Keep policies as narrow as possible and lifetimes as short as your client flow allows.
- Which Laravel and PHP versions does this package support?
- The package is built as a standard Laravel service provider with facade integration, but the provided overview does not publish a version matrix. Check the composer.json require and require-dev constraints on the repository before adopting, and confirm your Laravel major version and PHP floor are covered. Also review the release notes and support policy for the current major line.
- Can this package issue temporary credentials for COS uploads from a browser or mobile app?
- Yes. That is the primary use case: the server requests a scoped, expiring federation token from Tencent Cloud STS and hands only that temporary credential to the client. The browser or mobile app then uses it for COS uploads or other cloud service calls without ever seeing your long-lived SecretKey. Scope the policy to the specific bucket, prefix, and actions the client needs.
- Is it safe to return federation tokens to untrusted clients?
- Temporary federation tokens are designed to be handed to clients, but safety depends on your policy and lifetime choices. Keep the SecretKey strictly server-side, restrict the policy to the minimum resources and actions, and use short expiries. Also avoid logging tokens and make sure your token endpoint is authenticated so only legitimate users can request credentials.
- How do I publish the package configuration file?
- Run php artisan vendor:publish and select the entry for this package, or pass the package's service provider with the --provider option. That copies the default config into your application's config directory so you can adjust region, endpoint, and credential references. Keep environment-specific values in .env files and cache the config in production.
- How should I test federation token generation without real Tencent Cloud credentials?
- Do not call Tencent Cloud STS in your test suite. Swap the facade or bind a fake implementation of the package's service into the container so your tests assert the policy and expiry you pass rather than the remote response. Keep a small number of integration tests against a sandbox account, gated behind environment variables and excluded from default CI runs.
- Can I use this package outside Laravel or without the facade?
- The package is a Laravel integration, so its configuration loading and service provider assume a Laravel application. If you need STS federation tokens in a non-Laravel PHP project, use the official Tencent Cloud SDK for PHP directly instead. Within Laravel you can resolve the service from the container rather than using the facade if you prefer constructor injection.
- What alternatives exist for generating Tencent Cloud STS temporary credentials?
- The official Tencent Cloud SDK for PHP covers STS and can be called directly, and there are smaller standalone STS helper libraries. This package mainly adds Laravel-style configuration, a service provider, and a facade around that flow. Choose it if you want the Laravel integration, or use the official SDK if you need broader Tencent Cloud service coverage or framework independence.