Laravel Passport

Laravel Passport is an OAuth2 server and API authentication package that makes securing APIs simple and enjoyable. Built on top of the League OAuth2 Server, it adds the migrations, models, routes, and console commands needed to issue and manage access tokens directly inside a Laravel application.

Passport supports the full range of OAuth2 grants, personal access tokens, scopes, and token revocation, plus a first-party cookie-based flow for SPAs consuming your own API. It integrates with Laravel’s authentication guards so protecting routes is as familiar as any other auth driver.

What You Get

• A complete OAuth2 server with authorization code, client credentials, and password grants
• Personal access tokens and scoped API tokens via the HasApiTokens trait
• A passport authentication guard that plugs into Laravel’s auth system
• Artisan commands to install keys, create clients, and purge expired tokens
• A cookie-based token flow for first-party SPAs consuming your own API

Common Use Cases

• Securing a REST or JSON API with OAuth2 access tokens
• Issuing personal access tokens for third-party developers
• Authenticating a first-party single-page app against your own backend
• Managing OAuth clients, scopes, and token revocation for partners

Under The Hood

Architecture - Passport bootstraps through src/PassportServiceProvider.php, which registers routes, the passport guard (src/Guards), and the database-backed repositories (ClientRepository, TokenRepository). The src/Bridge directory adapts Passport’s Eloquent models to the league/oauth2-server interfaces, while HasApiTokens.php gives user models token-issuing helpers and Passport.php holds global configuration and scope registration.

Tech Stack - PHP 8.2+ built on league/oauth2-server for the OAuth2 protocol, firebase/php-jwt and phpseclib for token signing, and a broad set of illuminate/* components for auth, database, HTTP, and console integration. It targets Laravel 11, 12, and 13 and uses Symfony console and PSR HTTP message bridging.

Code Quality - The repository ships extensive Feature and Unit test suites (tests/Feature, tests/Unit) with dedicated signing keys fixtures, covering grants, token lifecycle, and guard behavior. The code is organized into clear namespaces (Http, Bridge, Console, Events, Exceptions) and is actively maintained by the Laravel core team.

API Design - The developer experience is deliberately Laravel-native: add the HasApiTokens trait, run passport:install, set the guard driver, and protect routes with the auth:api middleware. Fluent helpers like Passport::tokensCan() and createToken() keep common OAuth tasks concise and discoverable.