Weave Code
Api Key Bundle Laravel Package
uecode/api-key-bundle
A Symfony bundle that adds API key authentication to your application, letting you generate, store, and validate keys for users or clients without building the plumbing yourself.
UecodeApiKeyBundle adds simple API key authentication to Symfony applications. It protects firewalls with keys stored as Doctrine entities, authenticating requests through a configurable header or query parameter—ideal for securing APIs and service-to-service endpoints without full user login flows.
- Symfony security integration via authenticator/listener
- Doctrine-backed API keys with configurable provider
- Flexible key lookup from headers or request parameters
- Straightforward setup through bundle and firewall configuration
Frequently asked questions about Api Key Bundle
- Is uecode/api-key-bundle compatible with Laravel?
- No. It is a Symfony2 bundle that binds to the Symfony kernel through a Bundle class, service container configuration, and Symfony's security firewall, none of which Laravel provides. Loading it into Laravel would require pulling in Symfony 2.x HttpKernel, DependencyInjection, and Security components. For a Laravel application the effective fit is zero.
- How do I install uecode/api-key-bundle?
- It is installed with Composer into a Symfony 2.x application and then registered in AppKernel as a Symfony bundle. There is no Laravel service provider or facade, so the normal Laravel package discovery flow does not apply. If you are on Laravel, do not install it; use Laravel Sanctum or a custom guard instead.
- Does uecode/api-key-bundle require FOSUserBundle?
- Yes, the bundle hard-depends on FOSUserBundle, which pins the host application to Doctrine ORM user providers and Symfony's older security model. That creates a three-way coupling between this bundle, FOSUserBundle, and a Doctrine user entity. FOSUserBundle has been effectively unmaintained for years, which makes the dependency chain a long-term liability.
- Can I use uecode/api-key-bundle on Symfony 5, 6, or 7 with PHP 8?
- No. The last release was 2016-01-14, there are no PHP 7.4 or 8.x compatibility guarantees, and there is no Composer constraint allowing modern Symfony. It targets Symfony 2.8/3.x era stacks with older PHP versions. Treat it as incompatible with Laravel 9/10/11 and Symfony 5/6/7.
- What is the best Laravel alternative for API key authentication?
- Laravel Sanctum is first-party maintained and already ships personal access tokens with hashed storage and per-token metadata. If you need custom expiry, scopes, or rotation semantics, build a small api_keys table with user_id, name, hashed_key, last_used_at, and expires_at, plus a guard or middleware. Both options are far lighter than adapting a Symfony2 bundle.
- Is uecode/api-key-bundle still maintained and safe for production?
- It is dormant: last release 2016-01-14, around 61 stars, and no security response capability. It has no timing-safe key comparison guarantees, no rate limiting, and no key scoping or expiry semantics. Unpatched third-party authentication code sitting on your auth boundary is a high-risk liability. The Apache-2.0 license is permissive, but licensing is the only clean signal here.
- How does uecode/api-key-bundle authenticate API requests?
- It provides Doctrine-backed API keys, request listeners, and Symfony security integration, typically enabled through a security firewall setting such as api_key: true. The listener identifies the client from a configurable key on the request and resolves it to a user. This mechanism is specific to Symfony's firewall system and has no equivalent in Laravel's auth pipeline.
- Does uecode/api-key-bundle support key expiry, scopes, or rotation?
- No. The bundle models neither multi-key-per-user, expiry, scopes, nor rotation. It also does not provide rate limiting or modern timing-safe comparison patterns. If you need those semantics, you must implement them yourself in a Laravel-native guard or use Sanctum.
- How do I migrate from uecode/api-key-bundle to Laravel Sanctum?
- First inventory existing keys and determine whether they are stored plaintext or hashed, since a 2016-era bundle likely needs re-hashing on next use. Dual-write during the transition so old keys keep working while the new guard is validated. At cutover, rotate all keys rather than preserving them because the integrity of the old store cannot be assured, and decommission the Symfony firewall binding last. If no Symfony 2.x app is running the bundle, there is nothing to migrate.
- Should I adapt uecode/api-key-bundle for a Laravel project or reimplement it?
- Do not integrate it; reimplement the feature natively. The core value — authenticating a request by an API key associated with a user — is roughly a database column, a key-hashing routine, and one guard or middleware. The dependency weight of this bundle is orders of magnitude larger than the feature. In Laravel, evaluate Sanctum first and only build custom code if scope, expiry, or rotation requirements demand it.
Weaver
How can I help you explore Laravel packages today?