Search
Close this search box.
Search
Close this search box.

Building API Authentication with Laravel Passport

Building API Authentication

Introduction

API stands for Application Programming Interface. It is a  code or interface in Java that allows smooth communication Among software or programs, in this case using the same packages. RESTful APIs are fundamental for modern JavaScript frameworks or building mobile applications. The user needs tokens for authorization or authentication of the application. In the case of software development, API handles data through HTTP requests and manages CRUD operations.

Laravel is a platform that makes the building of APIs extremely easy. By using the Laravel passport, one can quickly secure the backend of the applications by authenticating the users through API. In the API ecosystem, one does not maintain the session state among requests. This article will guide you step by step to provide an additional layer of security to your Laravel APIs.

Laravel Passport: what is it?

In simple words, Laravel passport is an API authentication package and an OAuth2 server. It is a platform containing a substantial amount of boilerplate codes for the authentication of users. To implement the packages, including functions for generating tokens, migration tables, or authentication of Middleware,  one just needs to adjust some basic configurations on the Laravel passport platform. Software companies have a demand for people with vast knowledge of Laravel and are looking forward to hire Laravel developers.

Requirements:

  • COMPOSER – globally installed to manage dependencies
  • POSTMAN – to test the endpoints
  • Basic knowledge of application building.

Installing Laravel Passport:

  • For installation of Laravel Passport, first, you need to run the mentioned.

command:

composer require laravel/passport

  • Once the installation of the passport package is successful, the following step is passport migration for storing the tokens in new tables.

php artisan migrate

  • After the migration of the tables, running the following command will install it completely.

php artisan passport:install

  • Code for the configuration of the passport module; you need to open the app/Models/User.php file to include the HasApiTokens trait in the user model.

In the following section, we will configure the passport’s routes controller of authentication.

  • You have to add the Passport::routes method in the AuthServiceProvider to generate the necessary routes. We can specify the default lifetime expiry date of personal access tokens that we are issuing to the users using the boot() function.
  • We need to set the passport as the API authentication guard. By modifying the config/auth.php, henceforth, all applications can use Passport’s TokenGuard to authenticate all incoming API requests.
  • Our primary focus is ensuring that only authenticated users can access the specified routes. To focus on this aspect, you need to protect the /user and /logout endpoints and keep the /login and /signup  endpoints publicly accessible.

Next, we will create routes by adding routes in the routes/api.php file.

We also need to create an API controller for the REST API in Laravel.

  • For this purpose, we need to run the below-mentioned Artisan command to create a new controller.

🌕 php artisan make: controller ApiController.php

<?php

namespace App\Http\Controllers\Auth;

use App\User;
use App\Traits\ApiResponser;
use Illuminate\Http\Request;
use Laravel\Passport\Passport;
use App\Http\Controllers\Controller;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;

class AuthController extends Controller
{
use ApiResponser;

public function login(Request $request)
{
$attr = $this->validateLogin($request);

if (!Auth::attempt($attr)) {
return $this->error(‘Credentials mismatch’, 401);
}

return $this->token($this->getPersonalAccessToken());
}

public function signup(Request $request)
{
$attr = $this->validateSignup($request);

User::create([
‘name’ => $attr[‘name’],
’email’ => $attr[’email’],
‘password’ => Hash::make($attr[‘password’])
]);

Auth::attempt([’email’ => $attr[’email’], ‘password’ => $attr[‘password’]]);

return $this->token($this->getPersonalAccessToken(), ‘User Created’, 201);
}

public function user()
{
return $this->success(Auth::user());
}

public function logout()
{
Auth::user()->token()->revoke();
return $this->success(‘User Logged Out’, 200);
}

public function getPersonalAccessToken()
{
if (request()->remember_me === ‘true’)
Passport::personalAccessTokensExpireIn(now()->addDays(15));

return Auth::user()->createToken(‘Personal Access Token’);
}

public function validateLogin($request)
{
return $request->validate([
’email’ => ‘required|string|email|max:255’,
‘password’ => ‘required|string|min:6’,
]);
}

public function validateSignup($request)
{
return $request->validate([
‘name’ => ‘required|string’,
’email’ => ‘required|string|email|max:255|unique:users’,
‘password’ => ‘required|string|min:6|confirmed’,
]);
}
}

Here, in the signup() function, you need to create a new user according to the data requested by validating the data provided.

  • To generate a token, we can call a function getPersonalAccessToken().

The lifetime of the token can be stretched when we set the remember_me value to ‘true.’

  • Since the Passport Middleware protects the /user endpoint, we will always have access to the Auth::user() function.

After we have successfully created a controller for authentication, it is time to test the REST API. You can either use a virtual host for testing or test it on the PHP development server.

Generally, we use tools like Postman to test our API endpoints.

To initiate this process, you shall start by getting an access token for an already registered user. You can send a GET request to “API/login” by incorporating the email and password as parameters. If not registered,

  • Registration of API: Open The postman application and define “Accept”: application/JSON
  • Login Passport API: used to copy the bearer token and set it in the header section of the app. For logging in, you will have to check out the Laravel passport endpoint.
  • We need to set accurate authenticity to execute the CRUD operations. You will be receiving an access token after a successful registration. This access token’s manifestation establishes coherence with authorization to ensure secure transmission of data with the server.

You should save the access token as a

Bearer token in the authorization header.

Conclusion

Ultimately we completed The Laravel passport API tutorial. You can go through all the described foundation steps to build on this and design a secure API using Laravel passport. Mastering this process of developing secure APIs in Laravel Passport can ensure you get hired as a Laravel developer. Errors may arise in any step, depending on the code and its application, but through a continuous process of trial and error, one can develop a secure API quickly.


Subscribe to Our Newsletter

Related Articles

Top Trending

benny blanco net worth
Benny Blanco Net Worth: A Closer Look at His Wealth and Assets
India-Pakistan Ceasefire 2025
Why the 2025 India–Pakistan Ceasefire Might Not Hold
Australia E-Learning
How COVID-19 Permanently Shifted Australia’s E-Learning Habits?
Migrant Workers in the Gulf
Migrant Workers in the Gulf: Between Reform And Reality
Gender Reveal Balloons
The Ultimate Guide to Gender Reveal Balloons: Colors, Styles, and Surprises

LIFESTYLE

Gender Reveal Balloons
The Ultimate Guide to Gender Reveal Balloons: Colors, Styles, and Surprises
retirement cities in California
10 Best Retirement Cities in California for a Relaxed and Affordable Life
Mother's Day Around The World
Mother’s Day Traditions Around the World: Mother's Day 2025 Special
summer birthday party ideas
Creative Summer Birthday Party Ideas for Kids in 2025
May 6 Zodiac
May 6 Zodiac: Positive Traits, Compatibility and More about Taurus

Entertainment

benny blanco net worth
Benny Blanco Net Worth: A Closer Look at His Wealth and Assets
blake lively denies taylor swift blackmail claims
Blake Lively Denies Taylor Swift Blackmail Claim as 'False'
scarlett johansson slams oscars endgame black widow
Scarlett Johansson Slams Oscars for Snubbing ‘Endgame’
punchmade dev net worth
Punchmade Dev Net Worth: Is The Rapper Really As Rich As He Claims
teddi mellencamp divorce amid cancer battle
Teddi Mellencamp and Edwin Arroyave Divorce Amid Cancer Battle

GAMING

Responsible Gaming
How to Enhance Responsible Gaming?
BIOS Tweaks for Gaming Performance
7 Essential BIOS Tweaks For Maximum Gaming Performance
Gameboy Games
10 Gameboy Games You Should Revisit Today
Forgotten Game Consoles
7 Forgotten Consoles That Were Ahead of Their Time
Best Remastered Games
The Best Remastered Games That Stay True to the Originals

BUSINESS

Enterprise GRC Solutions
What Capabilities Matter Most in Enterprise GRC Solutions?
Hiring Fractional CMOs
8 Reasons Why Companies Love Hiring Fractional CMOs
Can ADA Continue
Can ADA Continue to a $100 Level?
Eco-Friendly Plumbing Companies That Save Water and Energy
10 Eco-Friendly Plumbing Companies Helping You Save Water and Energy Efficiently
legacy shave net worth
Legacy Shave Net Worth: What Happened After Shark Tank

TECHNOLOGY

Enterprise GRC Solutions
What Capabilities Matter Most in Enterprise GRC Solutions?
BIOS Tweaks for Gaming Performance
7 Essential BIOS Tweaks For Maximum Gaming Performance
Cryptogonow.com Buy Crypto
Cryptogonow.com: Your Go-To Destination to Buy Crypto
SoftOrbits denoise and deblur tools
SoftOrbits adds web functionality to its denoise and deblur tools
How to Change Snapchat AI Gender
How to Change Snapchat AI Gender: An Easy 5-Step Guide

HEALTH

Cattle Joint Supplements
Top Cattle Joint Supplements: Boosting Your Herd’s Health and Performance
Molar Implant Healing Timeline
The Healing Timeline After Getting Molar Implants
prolactin supplement for milk supply
How Does a Prolactin Supplement Support Milk Supply?
Egg Donation Procedure
The Egg Donation Procedure: What to Actually Expect
teddi mellencamp divorce amid cancer battle
Teddi Mellencamp and Edwin Arroyave Divorce Amid Cancer Battle