Weave Code
Token Builder Laravel Package
shetabit/token-builder
Shetabit Token Builder is a Laravel package for generating unique, customizable tokens and attaching them to Eloquent models. Configure character sets, length, prefixes, and uniqueness rules to create API keys, activation codes, or reference strings with simple, fluent methods.
a laravel package to generate temporary tokens/pins
Frequently asked questions about Token Builder
- How do I install shetabit/token-builder in a Laravel app?
- Install it with Composer using composer require shetabit/token-builder, then publish any provided configuration and migrations with the package's artisan commands. Add the package trait to the Eloquent model that should own tokens, and confirm Laravel auto-discovery registers the service provider. Run the migrations before creating tokens in development or staging.
- Which Laravel and PHP versions are supported by shetabit/token-builder v4?
- You should confirm supported PHP, Laravel, and database versions against the package's composer.json and release notes before upgrading. Version 4.0.0 is a major release, and the published notes are sparse, so do not assume v3 compatibility carries over automatically. Treat compatibility as unverified until you review the changelog and test in a staging environment.
- How do I generate a token or PIN for an Eloquent model?
- Attach the package trait to your model, then use the fluent token builder methods to create a token with your configured length, character set, prefix, and uniqueness rules. The generated token is associated with that model through the tokenable relationship. Review the package README for the exact method names and trait namespace for your installed version.
- Can I customize token length, character set, and prefix?
- Yes. The package is designed for customizable tokens, including character sets, length, prefixes, and uniqueness rules. You can typically configure defaults in the published config file and override them per token using fluent methods. Choose a character set and length that match your security needs, especially for PINs or activation codes.
- How does shetabit/token-builder handle uniqueness and token collisions?
- The package provides uniqueness rules so it can avoid generating duplicate tokens within the configured scope. You should still add a database unique index and handle collision retries or failures in your application code. Test collision behavior with short token lengths and large character sets before relying on it in production.
- What does the v4 find valid tokens feature do?
- Version 4.0.0 adds the ability to find valid tokens for a model without already knowing the token value. That is useful for token inventory, admin and audit views, revocation workflows, and lifecycle cleanup. Because it enables token discovery, verify exactly what the API returns, such as token records, metadata, or usable token values, before exposing it anywhere.
- Is token discovery or find valid tokens safe to expose in production?
- Token discovery is security-sensitive because it can become a leakage or enumeration surface if it is not tightly scoped and authorized. Do not expose raw token values through public APIs, and restrict discovery endpoints to trusted internal admin, support, or audit tooling. Add authorization boundaries, pagination, expiration filters, and bounded queries around any adoption of the v4 feature.
- Are tokens stored hashed, and will v3 tokens still work after upgrading to v4?
- The available release notes do not clearly state whether tokens are stored hashed or whether the v4 discovery API returns raw token strings versus token records or metadata. Review the v3-to-v4 diff and upgrade guide, then test existing token validation and revocation paths against production-like data. Keep applications pinned to v3 until v4 schema, hashing, and compatibility semantics are verified.
- How should I test token generation, expiration, and revocation in Laravel?
- Write feature tests using RefreshDatabase that cover token creation, uniqueness, validation, expiration, and revocation for the tokenable model. Add targeted tests for the v4 find valid tokens behavior, including authorization scoping and pagination. Run these tests in staging with production-like token data before rolling the upgrade out broadly.
- What are alternatives to shetabit/token-builder, and is it actively maintained?
- Alternatives depend on your use case: Laravel Sanctum or Passport for API authentication, framework random string helpers for simple reference codes, or custom token models when you need full control over hashing and lifecycle. Shetabit Token Builder has a small maintainer footprint, so assign an internal owner, pin versions, and monitor releases. The new contributor to v4 is a positive signal, but it does not replace maintainer and security review.
Weaver
How can I help you explore Laravel packages today?