Close this search box.
Close this search box.

Building API Authentication with Laravel Passport

Building API Authentication


API stands for Application Programming Interface. It is a  code or interface in Java that allows smooth communication Among software or programs, in this case using the same packages. RESTful APIs are fundamental for modern JavaScript frameworks or building mobile applications. The user needs tokens for authorization or authentication of the application. In the case of software development, API handles data through HTTP requests and manages CRUD operations.

Laravel is a platform that makes the building of APIs extremely easy. By using the Laravel passport, one can quickly secure the backend of the applications by authenticating the users through API. In the API ecosystem, one does not maintain the session state among requests. This article will guide you step by step to provide an additional layer of security to your Laravel APIs.

Laravel Passport: what is it?

In simple words, Laravel passport is an API authentication package and an OAuth2 server. It is a platform containing a substantial amount of boilerplate codes for the authentication of users. To implement the packages, including functions for generating tokens, migration tables, or authentication of Middleware,  one just needs to adjust some basic configurations on the Laravel passport platform. Software companies have a demand for people with vast knowledge of Laravel and are looking forward to hire Laravel developers.


  • COMPOSER – globally installed to manage dependencies
  • POSTMAN – to test the endpoints
  • Basic knowledge of application building.

Installing Laravel Passport:

  • For installation of Laravel Passport, first, you need to run the mentioned.


composer require laravel/passport

  • Once the installation of the passport package is successful, the following step is passport migration for storing the tokens in new tables.

php artisan migrate

  • After the migration of the tables, running the following command will install it completely.

php artisan passport:install

  • Code for the configuration of the passport module; you need to open the app/Models/User.php file to include the HasApiTokens trait in the user model.

In the following section, we will configure the passport’s routes controller of authentication.

  • You have to add the Passport::routes method in the AuthServiceProvider to generate the necessary routes. We can specify the default lifetime expiry date of personal access tokens that we are issuing to the users using the boot() function.
  • We need to set the passport as the API authentication guard. By modifying the config/auth.php, henceforth, all applications can use Passport’s TokenGuard to authenticate all incoming API requests.
  • Our primary focus is ensuring that only authenticated users can access the specified routes. To focus on this aspect, you need to protect the /user and /logout endpoints and keep the /login and /signup  endpoints publicly accessible.

Next, we will create routes by adding routes in the routes/api.php file.

We also need to create an API controller for the REST API in Laravel.

  • For this purpose, we need to run the below-mentioned Artisan command to create a new controller.

🌕 php artisan make: controller ApiController.php


namespace App\Http\Controllers\Auth;

use App\User;
use App\Traits\ApiResponser;
use Illuminate\Http\Request;
use Laravel\Passport\Passport;
use App\Http\Controllers\Controller;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;

class AuthController extends Controller
use ApiResponser;

public function login(Request $request)
$attr = $this->validateLogin($request);

if (!Auth::attempt($attr)) {
return $this->error(‘Credentials mismatch’, 401);

return $this->token($this->getPersonalAccessToken());

public function signup(Request $request)
$attr = $this->validateSignup($request);

‘name’ => $attr[‘name’],
’email’ => $attr[’email’],
‘password’ => Hash::make($attr[‘password’])

Auth::attempt([’email’ => $attr[’email’], ‘password’ => $attr[‘password’]]);

return $this->token($this->getPersonalAccessToken(), ‘User Created’, 201);

public function user()
return $this->success(Auth::user());

public function logout()
return $this->success(‘User Logged Out’, 200);

public function getPersonalAccessToken()
if (request()->remember_me === ‘true’)

return Auth::user()->createToken(‘Personal Access Token’);

public function validateLogin($request)
return $request->validate([
’email’ => ‘required|string|email|max:255’,
‘password’ => ‘required|string|min:6’,

public function validateSignup($request)
return $request->validate([
‘name’ => ‘required|string’,
’email’ => ‘required|string|email|max:255|unique:users’,
‘password’ => ‘required|string|min:6|confirmed’,

Here, in the signup() function, you need to create a new user according to the data requested by validating the data provided.

  • To generate a token, we can call a function getPersonalAccessToken().

The lifetime of the token can be stretched when we set the remember_me value to ‘true.’

  • Since the Passport Middleware protects the /user endpoint, we will always have access to the Auth::user() function.

After we have successfully created a controller for authentication, it is time to test the REST API. You can either use a virtual host for testing or test it on the PHP development server.

Generally, we use tools like Postman to test our API endpoints.

To initiate this process, you shall start by getting an access token for an already registered user. You can send a GET request to “API/login” by incorporating the email and password as parameters. If not registered,

  • Registration of API: Open The postman application and define “Accept”: application/JSON
  • Login Passport API: used to copy the bearer token and set it in the header section of the app. For logging in, you will have to check out the Laravel passport endpoint.
  • We need to set accurate authenticity to execute the CRUD operations. You will be receiving an access token after a successful registration. This access token’s manifestation establishes coherence with authorization to ensure secure transmission of data with the server.

You should save the access token as a

Bearer token in the authorization header.


Ultimately we completed The Laravel passport API tutorial. You can go through all the described foundation steps to build on this and design a secure API using Laravel passport. Mastering this process of developing secure APIs in Laravel Passport can ensure you get hired as a Laravel developer. Errors may arise in any step, depending on the code and its application, but through a continuous process of trial and error, one can develop a secure API quickly.

Subscribe to Our Newsletter

Related Articles

Top Trending

who is rachel hollis boyfriend
Rachel Hollis’ Long-Term Relationship: The Story Behind Her Boyfriend Cez Darke
clary fisher
The Life and Career of Clary Fisher: From Marriage to Divorce
chad dorman wife
The Tragic Story of Chad Dorman's Wife Laura Dorman
Google Apologizes for AI's Shocking Replies
Google Apologizes for AI's Shocking Replies on Controversial Figures
Top Healthiest and Unhealthiest Countries
Top Healthiest and Unhealthiest Countries Globally - 2024 Rankings


Egyptian Cotton Sheets for Your Bed
A Beginner's Guide to Choosing the Perfect Egyptian Cotton Sheets for Your Bed
Long Lehenga Choli
Elegance Redefined: Navigating the Diverse World of Long Lehenga Choli Designs
valentines day outfits
Top 20 Trendy Valentine's Day Outfits in 2024 For Every Occasion
eldritch foundry
Unleash Your Imagination With Eldritch Foundry Custom Miniatures
jayda wayda braids
How Long Do Jayda Wayda Braids Last [Durability and Maintenance Tips]


paige vanzant leaks
Exposing the Truth: The Controversy Surrounding Paige VanZant Leaks
schavaria reeves accident
The Truth Behind Schavaria Reeves Accident: What Really Happened?
bill boals
The Life and Career of Bill Boals: Husband of Margo Martindale
is terrifier based on a true story
Exploring the Truth: Is 'Terrifier' Truly Based on a Real Story?
losmovies alternatives
180 LosMovies Alternatives for Watching Movies and Series in 2024


Crypto Gambling Innovations
Innovations in Crypto Gambling: Shaping the Future of Online Betting
User Experience Design in Online Casinos
The Role of User Experience Design in Online Casino Platforms
New Online Service for Fans of Sports Betting and Casino Games
A New Online Service for Fans of Sports Betting and Casino Games
Are Online Gaming Bonuses Worth Pursuing
Are Online Gaming Bonuses Worth Pursuing These Days?
why does turles look like goku
Why Does Turles Look Like Goku: The Saiyan Secret Explained


Work Life Balance Europe vs America Comparison
Europe vs America: Decoding Work-Life Balance Differences
Romania 28th Place EMEA Private Companies Ranking
Romania Rises to 28th in Top EMEA Destinations for Private Firms - PwC
Employee Advocacy
The Role of Employee Advocacy in Enhancing Your Online Reputation
Top 10 World's Wealthiest Men
Top 10 World's Wealthiest Men: 2024 Rankings Revealed
Complexities of Pricing Algorithms
Navigating the Complexities of Pricing Algorithms


Google Apologizes for AI's Shocking Replies
Google Apologizes for AI's Shocking Replies on Controversial Figures
How to Encrypt Your Gmail Messages
Is Gmail Closing in August? Google Clears the Air
Software Development Career Success Tips
Tips For Succeeding In Your New Career As a Software Developer
Elon Musk
Elon Musk Hints Xmail Launch: A New Gmail Alternative
Laser Marking
Laser Marking: A Catalyst for Industrial Innovation and Sustainability


Top Healthiest and Unhealthiest Countries
Top Healthiest and Unhealthiest Countries Globally - 2024 Rankings
Best Way to Prevent Gum Disease
What is the Best Way to Prevent Gum Disease?
Norovirus Outbreak Northeast CDC Data
Norovirus Outbreak Hits Northeast: Latest CDC Data Reveals Spread
Brain Stimulation RTMS vs DTMS
Decoding Brain Stimulation Therapies: RTMS vs DTMS Explained
Top 10 Easy Stress & Anxiety Relief Techniques
Top 10 Easy Stress & Anxiety Relief Techniques - Find Calm Fast