Request a token

Once you create a password-granted client, you can issue a POST to the /oauth/token route using the user's email address and password. request to obtain an access token. The route has been registered by the Passport::routes method, so there is no need to define it manually. If the request is successful, you will receive an access_token and refresh_token in the JSON response returned by the server:

$http = new GuzzleHttp\Client;
$response = $http->post('http://your-app.com/oauth/token', [
    'form_params' => [   
         'grant_type' => 'password',        
         'client_id' => 'client-id',        
         'client_secret' => 'client-secret',        
         'username' => 'taylor@laravel.com',        
         'password' => 'my-password',        
         'scope' => '',    
         ],]);
   return json_decode((string) $response->getBody(), true);

{tip} By default, access Tokens are valid for a long time. You can Configure the validity time of the access token as needed.

Request all scopes

When using the password authorization mechanism, you can request the scope parameter* to authorize all ranges of tokens supported by the application. If your request contains parameters with scope *, the can method on the token instance will always return true. Authorizations of this scope can only be assigned to tokens issued when authorizing using password:

$response = $http->post('http://your-app.com/oauth/token', [
    'form_params' => [   
         'grant_type' => 'password',        
         'client_id' => 'client-id',        
         'client_secret' => 'client-secret',        
         'username' => 'taylor@laravel.com',        
         'password' => 'my-password',        
         'scope' => '*',
        ],
      ]);

Custom username field

When using password authorization, Passport uses email as the "username" by default. However, you can customize the username field by defining a findForPassport method on the model:

<?php
    namespace App;
    use Laravel\Passport\HasApiTokens;
    use Illuminate\Notifications\Notifiable;
    use Illuminate\Foundation\Auth\User as Authenticatable;
    class User extends Authenticatable{  
      use HasApiTokens, Notifiable;    
      /**
     * 通过用户名找到对应的用户信息
     *
     * @param  string  $username
     * @return \App\User
     */   
      public function findForPassport($username) 
         {    
             return $this->where('username', $username)->first(); 
         }
      }

hidden Implicit authorization token

Implicit authorization is similar to authorization code authorization, but it only returns the token to the client without exchanging the authorization code. This authorization is most commonly used for JavaScript or mobile applications that cannot store client credentials securely. Enable this authorization by calling the enableImplicitGrant method in AuthServiceProvider:

/**
 * 注册认证 / 授权服务
 *
 * @return void
 */
 public function boot(){
     $this->registerPolicies();    
     Passport::routes();    
     Passport::enableImplicitGrant();
    }

After calling the above method to enable authorization, developers can use their client ID to access the authorization from the application The program requests an access token. The connected application should make a redirect request to your application's /oauth/authorize route, as shown below:

Route::get('/redirect', function () {
    $query = http_build_query([   
         'client_id' => 'client-id',        
         'redirect_uri' => 'http://example.com/callback',        
         'response_type' => 'token',        
         'scope' => '',    
         ]);    
    return redirect('http://your-app.com/oauth/authorize?'.$query);
  });

{tip} Note, The /oauth/authorize route has already been defined in the Passport::routes method, so there is no need to manually define this route again.

Client Credential Grant Token

Client Credential Grant is suitable for machine-to-machine authentication. For example, you can use this authorization to perform maintenance tasks through the API.

Before client credential authorization, you need to create a client credential authorization client. You can use the --client parameter of the passport:client command to Create:

php artisan passport:client --client

Next, to use this authorization, you first need to add the new middleware in the $routeMiddleware variable of app/Http/Kernel.php File:

use Laravel\Passport\Http\Middleware\CheckClientCredentials;
protected $routeMiddleware = [
    'client' => CheckClientCredentials::class,
  ];

Then, append this middleware to the route:

Route::get('/orders', function (Request $request) {
    ...
 })->middleware('client');

If you want to limit access to the route to a certain scope, you can add client Provide a comma-separated list of required scopes when the middleware is attached to a route:

Route::get('/orders', function (Request $request) {
    ...
})->middleware('client:check-status,your-scope');

Get the token

by requesting oauth/token The interface sends a request to obtain the token:

$guzzle = new GuzzleHttp\Client;
$response = $guzzle->post('http://your-app.com/oauth/token', [ 
   'form_params' => [ 
          'grant_type' => 'client_credentials',        
          'client_id' => 'client-id',        
          'client_secret' => 'client-secret',        
          'scope' => 'your-scope',    
         ],]);
   return json_decode((string) $response->getBody(), true)['access_token'];

Personal access token

Sometimes, the user needs to be in the Issue an access token to yourself without going through the traditional authorization code redirection process. Allowing users to issue tokens to themselves through the application UI can help users experience your API, or it can be used as a simpler way to issue access tokens.

{note} The personal access token is permanently valid, and its life cycle will not be modified even if the tokensExpireIn and refreshTokensExpireIn methods are used.

Create a Personal Access Client

Before your application issues a Personal Access Token, You need to bring the --personal parameter after the passport:client command to create the corresponding client. If you have already run the passport:install command, you do not need to run this command again:

php artisan passport:client --personal

If you have already created a Personal Access client, you can do this by calling AuthServiceProvider in the personalAccessClientId method to enable:

/**
 * 注册认证 / 授权服务
 *
 * @return void
 */
 public function boot(){ 
    $this->registerPolicies();    
    Passport::routes();    
    Passport::personalAccessClientId('client-id');
  }

Manage Personal Access Token

After creating a personal access client, you can use the createToken method on the User model instance to issue a token for a given user. The createToken method accepts the name of the token as its first argument and an optional scope array as its second argument:

$user = App\User::find(1);
// 创建没有作用域的访问令牌...
$token = $user->createToken('Token Name')->accessToken;
// 创建有作用域的访问令牌...
$token = $user->createToken('My Token', ['place-orders'])->accessToken;

JSON API

Passport also has a JSON API for managing personal access tokens, which you can pair with your own front end to provide users with a dashboard for managing personal access tokens. Below we describe all API interfaces for managing personal access tokens. For convenience, we use Axios to demonstrate making HTTP requests to the API interface. The

JSON API is protected by web and auth middleware; therefore, it can only be called from within your own application. It cannot be called from external sources.

{tip} If you don’t want to implement your own front-end interface for personal access token management, you can follow Quick Start with Front-End to build a fully functional front-end interface in a few minutes.

GET /oauth/scopes

This route returns all scopes defined in the application . You can use this route to list the scopes that a user may be assigned to personal access tokens:

axios.get('/oauth/scopes')
    .then(response => {
        console.log(response.data);    
      });

GET /oauth/personal-access-tokens

This route returns all personal access tokens created by the authenticated user. This is mainly used to list all users' tokens so they can edit or delete them:

axios.get('/oauth/personal-access-tokens')
    .then(response => {
        console.log(response.data);   
      });

POST /oauth/personal-access-tokens

This route is used to create a new personal access token. It requires two pieces of data: the name and scpoe of the token:

const data = {
    name: 'Token Name',
    scopes: []};
    axios.post('/oauth/personal-access-tokens', data)
        .then(response => {
            console.log(response.data.accessToken);    
        })    
        .catch (response => { 
               // 列出响应中错误...    
        });

##DELETE /oauth/personal-access-tokens /{token-id}

axios.delete('/oauth/personal-access-tokens/' + tokenId);

Passport contains a verification protection mechanism that can verify the access token passed in the request Card. After configuring

's watcher to use the passport driver, you only need to specify the auth:api middleware on any route that requires a valid access token:

Route::get('/user', function () {
    //
 })->middleware('auth:api');

Authorization

Bearer token. For example, when using the Guzzle HTTP library:

$response = $client->request('GET', '/api/user', [
    'headers' => [  
          'Accept' => 'application/json',        
          'Authorization' => 'Bearer '.$accessToken,    
         ],
      ]);

Token Scope

Scope allows API clients to request specific permissions when requesting account authorization. For example, if you are building an e-commerce application, not all API applications that connect to it will need the ability to place orders. You can allow connected API applications to only be authorized to access order shipping status. In other words, scoping allows users of an application to limit the actions that third-party applications can perform.

Define the scope

You can boot## of AuthServiceProvider # Use the Passport::tokensCan method to define the scope of the API. tokensCan The method accepts an array containing the scope name and description as parameters. The scope description will be displayed directly to the user on the authorization confirmation page. You can define it to whatever you need:

use Laravel\Passport\Passport;
Passport::tokensCan([
    'place-orders' => 'Place orders',    
    'check-status' => 'Check order status',
  ]);

Passport::setDefaultScope# in the boot method of AuthServiceProvider ## Method to define the default scope.

use Laravel\Passport\Passport;Passport::setDefaultScope([
    'check-status',    
    'place-orders',
  ]);

When requesting an access token using an authorization code, the connected application needs to specify the required scope for the

parameter. scope When the parameter contains multiple scopes, use spaces to separate the names:

Route::get('/redirect', function () {
    $query = http_build_query([  
          'client_id' => 'client-id',        
          'redirect_uri' => 'http://example.com/callback',        
          'response_type' => 'code',        
          'scope' => 'place-orders check-status',   
        ]);    
 return redirect('http://your-app.com/oauth/authorize?'.$query);});

Use

createToken method of the User model issues a personal access token, you can pass the array of required scopes as the second parameter to this method:

$token = $user->createToken('My Token', ['place-orders'])->accessToken;

Passport contains two middlewares that can be used to verify that incoming requests contain a token to access the specified scope. Before use, you need to add the following middleware to the

attribute of the app/Http/Kernel.php file:

'scopes' => \Laravel\Passport\Http\Middleware\CheckScopes::class,
'scope' => \Laravel\Passport\Http\Middleware\CheckForAnyScope::class,

Routes can use the

middleware to check whether the current request has the specified all scopes:

Route::get('/orders', function () { 
   // Access token has both "check-status" and "place-orders" scopes...
   })->middleware('scopes:check-status,place-orders');

Routes can use the

middleware to check whether the current request has the specified any scope:

Route::get('/orders', function () {
    // 访问令牌具有 "check-status" 或 "place-orders" 作用域...
  })->middleware('scope:check-status,place-orders');

Check the scope on the token instance

Even if the request containing the access token verification has been authenticated by the application, you can still use the current authorization User## on the instance #tokenCan method to verify that the token has the specified scope:

use Illuminate\Http\Request;
Route::get('/orders', function (Request $request) {
    if ($request->user()->tokenCan('place-orders')) { 
           //    
         }
     });

scopeIds method will return Array of all defined IDs/names:

Laravel\Passport\Passport::scopeIds();

scopes The method will return an Laravel\Passport\Scope instance containing an array of all defined scopes:

Laravel\Passport\Passport::scopes();

scopesFor method will return an array of Laravel\Passport\Scope instances that match the given ID/name:

Laravel\Passport\Passport::scopesFor(['place-orders', 'check-status']);

The hasScope method determines whether a given scope has been defined:

Laravel\Passport\Passport::hasScope('place-orders');

CreateFreshApiToken middleware to the web middleware group in the app/Http/Kernel.php file:

'web' => [ 
   // 其他中间件...
    \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,
   ],

{note} You should ensure that the

EncryptCookies middleware is listed before the CreateFreshApiToken middleware in your middleware stack.

laravel_token cookie to all your outbound requests. This cookie will contain an encrypted JWT that Passport will use to authenticate API requests from JavaScript applications. At this point, you can make requests to your application's API without explicitly passing the access token:

axios.get('/api/user')
    .then(response => {
        console.log(response.data);    
     });

Passport::cookie method in the boot method of AuthServiceProvider to customize the name of the laravel_token cookie.

/**
 * 注册认证 / 授权服务
 *
 * @return void
 */
 public function boot(){
     $this->registerPolicies();    
     Passport::routes();    
     Passport::cookie('custom_name');
   }

X-CSRF-TOKEN and X-Requested-With Request header. Additionally, you must ensure that the HTML meta tag tag contains the CSRF token:

// In your application layout...
<meta name="csrf-token" content="{{ csrf_token() }}">
// Laravel's JavaScript scaffolding...
window.axios.defaults.headers.common = {
    'X-Requested-With': 'XMLHttpRequest',
   };

/**
 * 应用程序事件监听映射
 *
 * @var array
 */
 protected $listen = [
     'Laravel\Passport\Events\AccessTokenCreated' => [
             'App\Listeners\RevokeOldTokens', 
               ],    
      'Laravel\Passport\Events\RefreshTokenCreated' => [ 
             'App\Listeners\PruneOldTokens',   
             ],
         ];

use App\User;
use Laravel\Passport\Passport;
public function testServerCreation(){
    Passport::actingAs(  
          factory(User::class)->create(),   
               ['create-servers']  
             );    
         $response = $this->post('/api/create-server');    
        $response->assertStatus(201);
     }