Search by

juststeveking / kit

JustSteveKing

Opinionated Laravel API starter kit: token authentication, standards-compliant HTTP via api-toolbox, and contract-tested OpenAPI docs.

Package info

github.com/JustSteveKing/kit

Type:project

pkg:composer/juststeveking/kit

Security

Advisories: 0

Aikido package health analysis

Transparency log

Statistics

Installs: 8

Dependents: 0

Suggesters: 0

Stars: 115

Open Issues: 0

v0.1.5 2026-10-20 12:01 UTC

Requires

Requires (Dev)

Suggests

None

Provides

None

Conflicts

None

Replaces

None

MIT da2b7fe9647b11c40d437657007057f5b06ca393

apilaravelstarter-kitsanctumrfc9457

Published on Packagist.org on 2026-10-20 12:02 UTC

This package is auto-updated.

Last update: 2026-10-20 15:05:13 UTC

README

A Laravel starter kit for token-authenticated APIs, built on the published HTTP standards. Every error is RFC 9457 problem details, creating things takes an Idempotency-Key, lists page through Link headers, webhooks go out as signed CloudEvents, and the OpenAPI spec is checked against the running API on every build. It ships with a production image on Octane and FrankenPHP.

The standards themselves come from api-toolbox. Kit is the application around it, with the conventions already in place and a CI pipeline that fails when something breaks them.

Install

laravel new my-api --using=juststeveking/kit
cd my-api

The installer sets up .env, the key and a migrated SQLite database. Emails are queued, so run a worker beside the API:

php artisan serve
php artisan queue:work

Routes live under http://127.0.0.1:8000/v1/, with no /api prefix, and mail goes to the log until you configure a mailer. Registering a user is a quick check that it all works:

curl -X POST http://127.0.0.1:8000/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"name": "Jane Doe", "email": "jane@example.com", "password": "Password123!", "device_name": "cli"}'

Getting started goes from here to an authenticated request.

What is in it

  • PHP 8.5, Laravel 13, Sanctum, Pest, PHPStan at level 10, Pint with the PER preset, and Rector
  • Invokable controllers, Form Requests, readonly payload objects and plain JSON resources
  • php artisan make:endpoint, which scaffolds an endpoint the way the rest of Kit is built
  • Every error as application/problem+json, typed from the apiguide.dev catalogue, with a detail translated from Accept-Language
  • Idempotency-Key, Deprecation and Sunset, Link header pagination, ETags, request IDs and W3C trace context, and an API catalog at /.well-known/api-catalog
  • Outbound webhooks that consumers subscribe to themselves: CloudEvents, signed with RFC 9421, retried on a published schedule, and recorded attempt by attempt
  • OpenAPI from Scribe attributes, contract tests that compare the spec with real responses, and a legible gate that keeps it readable by agents
  • A Dockerfile for Octane on FrankenPHP, built and booted in CI on every push
  • Laravel Vet auditing every dependency, and a weekly update PR
  • An AGENTS.md that tells coding agents how to build on Kit without undoing it

Documentation

Page What it covers
Getting started Installing, running locally, your first requests, where things live
Authentication Session tokens, API keys, abilities, verification and password reset
Building endpoints make:endpoint and each piece it writes
Errors Problem details, and raising errors of your own
HTTP standards Idempotency, pagination, ETags, deprecation, request IDs, media types
Localization Accept-Language, translated errors, adding a language
Webhooks What subscribers receive, and adding your own events
API documentation Scribe, the OpenAPI spec, contract tests and legible
Security Transport, CORS, trusted hosts, rate limits and audit logging
Deployment The Docker image, workers, the scheduler and Octane
Quality and CI The checks, the workflows, and reviewing dependencies with Vet
Configuration Every environment variable Kit adds

License

MIT