hmacauth/laravel-hmac-auth

HMAC API authentication for Laravel with signature verification, replay attack prevention, and rate limiting

v1.0.0 2026-01-16 14:55 UTC

Requires

• php: ^8.3
• illuminate/contracts: ^11.0|^12.0
• illuminate/database: ^11.0|^12.0
• illuminate/encryption: ^11.0|^12.0
• illuminate/http: ^11.0|^12.0
• illuminate/routing: ^11.0|^12.0
• illuminate/support: ^11.0|^12.0

Requires (Dev)

• larastan/larastan: ^2.0|^3.0
• laravel/pint: ^1.0
• orchestra/testbench: ^9.0|^10.0
• pestphp/pest: ^3.0
• pestphp/pest-plugin-laravel: ^3.0

MIT

• Muhammad Waqas Majeed

• security
• api
• Authentication
• middleware
• signature
• laravel
• hmac
• nonce
• rate-limiting
• replay-attack
• octane
• request-signing

README

HMAC-based API authentication for Laravel 11/12.

Install

composer require hmacauth/laravel-hmac-auth
php artisan hmac:install
php artisan migrate
php artisan hmac:generate

Protect Routes

Route::middleware('hmac.verify')->group(function () {
    Route::post('/api/resource', ResourceController::class);
});

Documentation

See docs/ for full documentation:

• Getting Started
• Configuration
• Client Examples
• API Reference
• Commands
• Security
• Troubleshooting

Requirements

• PHP 8.3+
• Laravel 11.x / 12.x
• Redis

License

MIT