Laravel Passport - which grant to use for my users apps?

I have application where users can register and add their own applications (websites, mobile applications).

For each of these applications, I want to give access to my API and allow to get products form my database.

For example:
User X signup in my app, adds his blog user-X-blog.com and get access token. Next he can call to my API and get some products to show on his blog post.

Which grant should I implement to make my API based on Laravel Passport safe and useful (each user application with its own token, no user login required to make api call, long-lived tokens)?

Is it good idea to create for each user apps dedicated client and use client credentials grant? It doesn't look very safe for me (or maybe I'm wrong).

2 Answers
2

In your situation I think using Personal Access Tokens is the best option:

Each unique user who signs up and adds his blog post gets a unique token:

$user = AppUser::find(1);

// Creating a token without scopes...
$token = $user->createToken('Token Name')->accessToken;

// Creating a token with scopes...
$token = $user->createToken('My Token', ['place-orders'])->accessToken;


You can then make requests and pass the token as an Authorization Header:

$response = $client->request('GET', '/api/user', [
'headers' => [
'Accept' => 'application/json',
'Authorization' => 'Bearer '.$accessToken,
],
]);


You can also set lifetimes for your tokens in the boot method of your AuthServiceProvider:

boot

AuthServiceProvider

public function boot()
{
$this->registerPolicies();

Passport::routes();

Passport::tokensExpireIn(now()->addDays(15));

Passport::refreshTokensExpireIn(now()->addDays(30));
}


personal access token is never used for third party access
– rkj
2 days ago

From your requirement it is clear that third party access your api. There are 2 way to allow third party access

But this approach is suitable if your client's user has account in your system. Like we use facebook, google etc.

You can use the second option. What you can do is signup your client at your side and generate client ID and client secret and then they will use this information to authenticate from their server to your server and your server return the access token. No client involvement and after that either their server or client can directly access your api using accessToken.

client ID

client secret

Hope it may clear your.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.