- What does stayallive/laravel-passport-memoized actually do?
- It swaps Laravel Passport's token and client repositories for memoized versions, so repeated lookups during the same request return an already-resolved result instead of hitting the database again. It ships as a drop-in service provider for applications that already use Passport. Your authentication code stays the same; the package just removes duplicate queries behind it.
- How do I install laravel-passport-memoized in a Laravel app?
- Install it with Composer using composer require stayallive/laravel-passport-memoized. Laravel's package auto-discovery registers the service provider, so manual registration is normally unnecessary. Afterwards run your existing authentication tests to confirm Passport still resolves tokens and clients correctly.
- Which Laravel versions does this package support?
- Release v1.0.6 widened the package's constraints to allow Laravel 12. Laravel 12 requires PHP 8.2 or newer, so check your runtime before upgrading. If you are on an older Laravel major, confirm the specific release you install still permits it rather than assuming backward support.
- Do I need to publish a config file or register the service provider manually?
- The package is described as a drop-in service provider, so no publishing step should be required for it to work. Check the README for any optional publish command or configuration keys if you want to override defaults. Publish the config only when you actually need to change behavior, since an unpublished config simply falls back to the package defaults.
- Is the memoization a persistent cache like Redis, or per request?
- Memoization here means repeated lookups within a single request or resolution cycle reuse the first fetched result instead of re-querying. It is not a shared cache such as Redis or a database cache table. That distinction matters because each new request starts fresh, so token expiry and revocation are still evaluated on the next incoming call.
- Do I have to change my Passport authentication code to use this package?
- No. The package rebinds Passport's repositories rather than changing the API your application calls, so guards, middleware, and token checks keep working unchanged. The only thing that changes is where the underlying token and client lookups come from. Run your existing auth test suite after installing to confirm nothing shifted.
- Is it safe to use with Laravel Octane or long-running queue workers?
- In a normal PHP-FPM request the memoized state disappears at the end of each request, which is the expected behavior. In long-running environments such as Octane workers or queue daemons, you should verify that the container and any resolved instances are reset between requests. If they are not, a memoized token could outlive the request that fetched it, so test this explicitly under Octane before shipping.
- How much performance improvement should I expect?
- The gain scales with how many times a single request resolves the same token or client. An endpoint that authenticates once may see little difference, while endpoints that repeatedly check tokens or resolve many OAuth clients benefit most because duplicate queries collapse into one. Profile your own routes with query logging rather than assuming a fixed speedup.
- How do I verify that the memoization is actually working?
- Enable query logging through DB::listen or Laravel Telescope, then hit an endpoint that performs more than one authentication or client lookup. Compare the number of oauth_access_tokens and oauth_clients queries before and after installing the package. If the count does not drop, your code path probably resolves each token only once anyway.
- Is the package actively maintained, and how hard is it to remove later?
- The project is a small, focused utility with tagged releases, the latest being v1.0.6, but release cadence and issue response times are worth checking on the repository before adopting it in a critical path. Removal is a Composer operation: composer remove stayallive/laravel-passport-memoized followed by a config cache clear. Because it is a repository-level wrapper rather than a data-owning package, you should not need a data migration to back it out, though confirming it publishes no migrations is a sensible final check.