Laravel Passport

How to make use of an authentication token for your API.

In some cases your API will not be used in possible attack pron platforms. Like when the end points are exposed in a private mobile platform. Yet in other cases your end points may need to be highly available for public use. So in these cases it is very important to make use of an authentication token.

Assuming you already have a laravel project created and before you even migrate your database tables, you would need to install the passport service provider. I mean calling it passport, what are we trying ship to the UK.  I do find the name a bit over the top but thats what they named it. We start the process with the following line.

composer require laravel/passport

This passport service provider will create its own database migrations. Now you can migrate your tables if you are already happy with the table structure. Then you run the following command to migrate all the tables.

php artisan migrate

The next step is to rush over to your Users model. The path should be app/Users.php. Then the code you add being HasApiTokens right after the “use Notifiable“. Not forgetting to import it as well.

namespace App;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Passport\HasApiTokens;

class User extends Authenticatable
{
    use Notifiable, HasApiTokens;

   

Browse through to the AuthServiceProvider file to add the code Passport::routes(); in the function boot. You would still need to remember to add the use Laravel\Passport\Passport;

Then change the authentication driver to passport. Path config/auth.php

  'api' => [
            'driver' => 'passport',
            'provider' => 'users',
            'hash' => false,
        ],
   

Create a Controller ideally where you are going to create your methods. Then the following code allows you to register a user whom when you login, you will receive an access token. The token will permit you to go through all endpoints.

use App\User;
use App\Http\Controllers\Controller;
use Illuminate\Http\Request;

class AuthController extends Controller
{
   public function register(Request $request){

      $validatedData = $request->validate([
          'name'      => 'required|max:55',
          'email'     => 'email|required',
          'password'  => 'required|confirmed'
      ]);

      //encrypt the password
      //$validatedData['password'] = bcrypt($validatedData['password']);
      $validatedData['password'] = bcrypt($request->password);

      $user = User::create($validatedData);

      $accessToken = $user->createToken('authToken')->accessToken;

      return response(['user' => $user, 'access_token'=> $accessToken]);

    }

My testing on postman still required me to ensure we send the request with headers with the rule that we accept json application. Once it works, then it means you are good to go.

  public function login(Request $request){

      $loginData = $request->validate([
          'email'     => 'email|required',
          'password'  => 'required'
      ]);

      
      if(!auth()->attempt($loginData)){
        return response(['message' => 'Invalid credentials']);
      }
      $accessToken = auth()->user()->createToken('authToken')->accessToken;
      return response(['user' => auth()->user(), 'access_token'=> $accessToken]);
    }
}