README

Drops in a POST /api/login and POST /api/logout pair backed by Laravel Sanctum personal access tokens, without wiring any routes or controllers into your app yourself. The authenticatable model is configurable, and the package fails fast if that model doesn't use Laravel\Sanctum\HasApiTokens.

Installation

You can install the package via composer:

composer require mileswu/sanctum-auth-api

Publish the config file (optional — only needed if you want to change the model):

php artisan vendor:publish --tag="sanctum-auth-api-config"

This is the contents of the published config file:

return [
    'model' => env('SANCTUM_AUTH_API_MODEL', 'App\Models\User'),
];

Point it at whichever model you authenticate against, either via .env:

SANCTUM_AUTH_API_MODEL="App\Models\Admin"

or directly in the config file. The model must use the Laravel\Sanctum\HasApiTokens trait and have email and password attributes — the package throws MilesWu\SanctumAuthApi\Exceptions\InvalidAuthenticatableModelException on login/logout if it doesn't.

Usage

The package registers its routes itself — you don't need to add anything to routes/api.php or bootstrap/app.php:

POST /api/login   -> throttle:10,1        -> name: sanctum-auth-api.login
POST /api/logout  -> auth:sanctum         -> name: sanctum-auth-api.logout

POST /api/login accepts email and password, and responds with:

{
    "token": "1|abcdef..."
}

POST /api/logout requires a Bearer token (via auth:sanctum) and revokes the token used to authenticate the request.

Testing

composer test

Changelog

Please see CHANGELOG for more information on what has changed recently.

Credits

Miles Wu

License

The MIT License (MIT). Please see License File for more information.

mileswu / sanctum-auth-api

Package info

Security

Statistics