Token Authenticator Laravel Package

Product Decisions This Supports

• Framework-fit triage (the highest-value output). Despite being scoped in a Laravel evaluation, this repo is a Symfony bundle (TokenAuthenticatorBundle) — a security firewall/guard for Symfony's security component, not a Laravel auth driver. A PM uses this finding to kill a candidate in one step rather than spending an engineering spike on it. That is a decision, and a cheap one.
• Build vs. buy vs. "already have it." Token auth for API/SPA/mobile clients is a solved problem in Laravel: Sanctum (first-party, free, maintained) covers personal access tokens and SPA cookie auth; Passport covers full OAuth2. This package's only real function is to confirm you should not build a token layer from scratch — and that the "buy" option is already bundled in the framework.
• Roadmap scope control. Adoption would require a fork-and-maintain commitment (last release April 2019, zero stars, zero dependents). That's a recurring maintenance line item against a one-time auth feature. The PM decision is to keep auth off the custom-maintenance roadmap entirely.
• Risk register / dependency due diligence. Useful as a worked example for a dependency policy: minimum bar on last-release recency, dependents count, and security-patch cadence. Zero dependents in seven years is a strong signal of no production hardening — no one has stress-tested the edge cases you will hit.
• Legacy-estate carve-out (the one legitimate use case). If the organization runs old Symfony 2/3 services, this may be a low-effort static-token guard for an internal service. It is a narrow, contained decision — not a platform decision.
• Migration and upgrade planning. A 2019 package will not support PHP 8.x idioms, modern Symfony security interfaces, or Laravel 10/11 at all. Any evaluation here should produce an explicit "does not unblock our upgrade" note for the platform team.

When to Consider This Package

Consider it only if all of the following hold:

• The consuming application is Symfony, not Laravel, and is pinned to a Symfony version contemporary with the 2019 release (roughly Symfony 3.4–4.x on PHP 7.x).
• The need is simple static bearer tokens for an internal or low-sensitivity service — no token rotation, no scopes, no refresh flow, no device management, no revocation UI.
• You have a named owner willing to fork it and carry security patches, with an accepted exit plan.
• The service is not internet-facing and is not in the PCI/PII blast radius.

Look elsewhere — decisively — if any of these are true:

• Laravel stack. Use Sanctum for API tokens and SPA auth; use Passport if you need OAuth2 (authorization code, client credentials, scopes). Both are first-party and maintained.
• You need JWT. Use firebase/php-jwt or tymon/jwt-auth; do not hand-roll.
• You need OAuth2 / OIDC / social login / enterprise SSO. Use Passport, league/oauth2-server, or an identity provider.
• You need MFA, token expiry policies, audit logging, or credential rotation — i.e., anything a security review will actually ask for. None of that is here.
• You require a supported dependency with a security-response path. A package with no releases in seven years has no patch channel; a CVE becomes your incident.

How to Pitch It (Stakeholders)

To executives: We evaluated youshido/token-authenticator and recommend not adopting it. Three reasons. First, it's a Symfony bundle — it does not fit our Laravel stack, which removes it on technical grounds alone. Second, it has had no release since April 2019, zero stars, and zero dependent projects, which means no one is maintaining or security-patching it; adopting it transfers that risk to us permanently. Third, the capability it would provide is already included free and maintained in Laravel via Sanctum and Passport. Net position: adopting this would add recurring maintenance cost and security exposure to get functionality we already own. Cost of the recommended path is zero; cost of the alternative is an on-call fork we must staff indefinitely.

To engineering: Two facts settle it. (1) TokenAuthenticatorBundle targets Symfony's security firewall — it will not register as a Laravel guard without a custom adapter we'd own. (2) It predates PHP 8 and modern Symfony security interfaces, so it's incompatible with our runtime and would need patching before the first line of integration code. Recommendation: use Sanctum for token issuance and validation; use Passport if the requirement is genuinely OAuth2 with scopes and grant types. If we need JWT specifically, firebase/php-jwt is the maintained primitive. Suggested next step is a half-day spike on Sanctum, not a fork evaluation — and if any legacy Symfony services surface, treat this package as an isolated internal tool with a named owner and a documented replacement date, never as a shared dependency.

The one-line ask: approve moving this candidate to "rejected — framework mismatch and unmaintained," and approve Sanctum as the default token-auth path.