altrntv/sanctum-refresh-tokens

Refresh token realization for laravel sanctum

1.0 2025-06-24 06:45 UTC

Requires

• php: ^8.4
• laravel/framework: ^12.0
• laravel/sanctum: ^4.0

MIT

• Pavel Dykin

• auth
• laravel
• sanctum

README

Installation

1. You can install the package via composer:

   composer require altrntv/sanctum-refresh-tokens
   

2. Publish migrations php artisan vendor:publish --tag=sanctum-refresh-tokens

3. Run migrations php artisan migrate

4. Extend your User model from Tokenable and HasSanctumTokens

   use Altrntv\SanctumRefreshTokens\Contracts\Tokenable;
   use Altrntv\SanctumRefreshTokens\HasSanctumTokens;
   
   class User implements Tokenable
   {
       use HasSanctumTokens;
   }

5. Add prune commands to Schedule

   use Illuminate\Support\Facades\Schedule;
   
   Schedule::command('sanctum:prune-expired --hours=0')->hourly();
   Schedule::command('sanctum:prune-refresh-expired --hours=0')->daily();

6. To change tokens expire time configure config/sanctum.php

   'expiration' => env('SANCTUM_ACCESS_TOKEN_EXPIRATION', 60), // minutes
   'refresh_token_expiration' => env('SANCTUM_REFRESH_TOKEN_EXPIRATION', 7 * 24 * 60), // minutes
   
   'token_prefix' => env('SANCTUM_TOKEN_PREFIX', ''),
   'refresh_token_prefix' => env('SANCTUM_REFRESH_TOKEN_PREFIX', ''),

Usage

Creating a refresh token

use Altrntv\SanctumRefreshTokens\Config\ConfigHelper;
use Altrntv\SanctumRefreshTokens\Contracts\Tokenable;

$accessTokenExpiresAt = ConfigHelper::accessTokenExpiresAt();
$refreshTokenExpiresAt = ConfigHelper::refreshTokenExpiresAt();

$accessToken = $user->createToken(
    name: 'access_token',
    expiresAt: $accessTokenExpiresAt,
);

$refreshToken = $user->createRefreshToken(
    personalAccessTokenId: $accessToken->accessToken->id,
    expiresAt: $refreshTokenExpiresAt,
);

return new TokenDTO(
    model: $user->getMorphClass(),
    tokenType: 'Bearer',
    accessToken: $accessToken->plainTextToken,
    accessTokenExpiresAt: $accessTokenExpiresAt,
    refreshToken: $refreshToken->plainTextToken,
    refreshTokenExpiresAt: $refreshTokenExpiresAt,
    user: $user,
);

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Credits

• Pavel Dykin
• All Contributors

License

The MIT License (MIT). Please see License File for more information.