- How do I install and set up ryangjchandler/bearer in a Laravel app?
- Install it with Composer, then publish the package config and migration files and run your migrations. Add the package's token trait to your User model, register the bearer guard in config/auth.php, and attach the middleware to the API routes you want to protect. It follows the standard Laravel package pattern and does not require forking the framework or hacking service providers.
- Which Laravel and PHP versions does ryangjchandler/bearer support?
- The package targets modern Laravel releases, with Laravel 10, 11, and 12 as the current practical stack and Laravel 13 support declared in v2.1.1. Because that Laravel 13 support arrived as a patch release widening the illuminate constraints, confirm the actual constraint range and PHP version floor before upgrading. Check the CI matrix to see which framework versions are genuinely exercised rather than only declared compatible.
- Are bearer tokens stored hashed in the database?
- Yes. The package is designed around hashed token storage, so the raw bearer token is shown to the client at issuance and only a hash is persisted. That limits the damage if the database is exposed, but it also means you cannot recover a lost token later and must issue a new one. Verify hashing behavior in the release diff when upgrading, since authentication internals are security-critical.
- How do I protect API routes with the bearer guard and middleware?
- Register the bearer guard in config/auth.php, then apply the package middleware to your API route groups or individual routes. Requests must include an Authorization: Bearer header containing a valid, unexpired token, and the guard resolves the associated user for the request. Unauthenticated requests should fail with a 401 before reaching your controller.
- Can bearer tokens have abilities and expiration dates?
- Yes. Tokens can be issued with abilities and an expiration timestamp, letting you restrict what a token can do and how long it remains valid. This is useful for scoped API access such as read-only integrations or short-lived machine tokens. It is intentionally simpler than a full OAuth2 scope hierarchy, so complex permission models may still need Sanctum or Passport.
- How is ryangjchandler/bearer different from Laravel Sanctum or Passport?
- Bearer is a minimal bearer-token guard: one guard, one token model, and one middleware, focused on token-authenticated JSON APIs. Sanctum is the better fit if you need first-party SPA cookie session authentication, while Passport is the choice for full OAuth2 and OIDC flows. Choose bearer when you want a thin, opinionated auth layer and do not need refresh-token rotation or fine-grained scope hierarchies.
- How do I issue a bearer token for a user and return it to the client?
- Use the token trait on your User model to create a token with the abilities and expiry you need. The raw token value is returned once at creation, so send it to the client immediately and store only the hash server-side. Treat the token like a password: transmit it over HTTPS and avoid logging it.
- How do I revoke or rotate bearer tokens, and what happens when a token expires?
- Revoke a token by deleting its database record, after which the guard will no longer authenticate requests using it. Expired tokens fail authentication automatically, so clients must obtain a new token. There is no built-in refresh-token rotation; implement rotation by issuing a new token and revoking the old one in the same flow.
- Is ryangjchandler/bearer actively maintained and safe for production?
- It is effectively a single-maintainer package with a thin contributor base, and the recent v2.1.1 release was a community-submitted Laravel 13 compatibility update. That shows the package is being kept alive, but it also means you should treat it as a tier-1 dependency, pin the version, and verify compatibility in your own smoke tests. Ask about the security disclosure process and patch latency before relying on it at the authentication boundary.
- How do I test token-authenticated Laravel routes?
- Write feature tests that call your protected endpoints with and without an Authorization: Bearer header, asserting 401 responses for missing or invalid tokens. Issue real tokens in the test setup so you exercise hashing, expiry, and ability checks end to end. Add cases for expired tokens and tokens lacking a required ability, and run this suite whenever you bump the package version.