> ## Documentation Index
> Fetch the complete documentation index at: https://kawax.biz/llms.txt
> Use this file to discover all available pages before exploring further.

# Laravel Passport (OAuth2 server implementation)

> Learn how to implement an OAuth2 server with Laravel Passport. Covers when to choose Passport versus Sanctum, installation, client management, and scope and token management.

## What is Passport

Laravel Passport is the official package for running a Laravel application as an OAuth2 authorization server.
Use it for third-party app integrations and APIs that require a strict OAuth2 flow.

```mermaid theme={null}
sequenceDiagram
    participant User as User
    participant Client as OAuth client
    participant App as Laravel app<br>(Passport)
    participant API as Protected API

    User->>Client: Start integration
    Client->>App: Authorization request
    App->>User: Show consent screen
    User->>App: Approve
    App-->>Client: Authorization code
    Client->>App: Exchange authorization code for access token
    App-->>Client: Access token
    Client->>API: Call API with bearer token
    API-->>Client: Response
```

## Passport vs Sanctum

Choose Passport if OAuth2 is required.
Choose Sanctum for simple API token authentication or SPA / mobile authentication.

| Aspect          | Passport                                                                      | Sanctum                                      |
| --------------- | ----------------------------------------------------------------------------- | -------------------------------------------- |
| Purpose         | OAuth2 server implementation                                                  | Simple API authentication                    |
| Well-suited for | External app integration, OAuth2 compliance, [MCP servers](/en/mcp#oauth-2-1) | First-party SPA, mobile, personal-use tokens |
| Complexity      | High                                                                          | Low                                          |

<Info>
  If you are building an [MCP server](/en/mcp) accessed by AI clients, Passport is officially recommended since MCP clients typically expect to authenticate using OAuth.
</Info>

## Installation

The official recommendation in Laravel 13 is `install:api --passport`.

```shell theme={null}
php artisan install:api --passport
```

For a manual installation on an existing project, you can also set it up with the following commands.

```shell theme={null}
composer require laravel/passport
php artisan passport:install
```

There are cases where you only want to generate keys on the initial deployment.

```shell theme={null}
php artisan passport:keys
```

## Configuration

### User model

Add the `HasApiTokens` trait and the `OAuthenticatable` interface to your `User` model.

```php theme={null}
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Passport\Contracts\OAuthenticatable;
use Laravel\Passport\HasApiTokens;

class User extends Authenticatable implements OAuthenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}
```

### auth guard

In the `api` guard of `config/auth.php`, use the `passport` driver.

```php theme={null}
'guards' => [
    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ],
],
```

### Service provider configuration

In your `AppServiceProvider`'s `boot()` method, you can define scopes and token expirations.

```php theme={null}
use Carbon\CarbonInterval;
use Laravel\Passport\Passport;

public function boot(): void
{
    Passport::tokensCan([
        'orders:read' => 'View orders',
        'orders:create' => 'Create orders',
    ]);

    Passport::defaultScopes(['orders:read']);

    Passport::tokensExpireIn(CarbonInterval::days(15));
    Passport::refreshTokensExpireIn(CarbonInterval::days(30));
    Passport::personalAccessTokensExpireIn(CarbonInterval::months(6));
}
```

## Client management

### Authorization code grant client

```shell theme={null}
php artisan passport:client
```

This client is used with the standard OAuth2 flow that involves a user consent screen.

### Client credentials grant client

```shell theme={null}
php artisan passport:client --client
```

For machine-to-machine endpoints, use the `EnsureClientIsResourceOwner` middleware.

```php theme={null}
use Laravel\Passport\Http\Middleware\EnsureClientIsResourceOwner;

Route::get('/orders', function () {
    // ...
})->middleware(EnsureClientIsResourceOwner::using('orders:read'));
```

## Token management

### Granting scopes

```php theme={null}
$accessToken = $user->createToken(
    'dashboard-token',
    ['orders:read', 'orders:create']
)->accessToken;
```

### Checking scopes

```php theme={null}
use Laravel\Passport\Http\Middleware\CheckToken;

Route::get('/orders', function () {
    // ...
})->middleware(['auth:api', CheckToken::using('orders:read')]);
```

### Revocation

```php theme={null}
use Laravel\Passport\Passport;

$token = Passport::token()->find($tokenId);
$token?->revoke();
```

## Protecting API routes

Attach `auth:api` to APIs protected by user access tokens.

```php theme={null}
Route::middleware('auth:api')->group(function () {
    Route::get('/user', fn (Request $request) => $request->user());
    Route::get('/orders', [OrderController::class, 'index']);
});
```

<Warning>
  For client credentials grant routes, use `EnsureClientIsResourceOwner` instead of `auth:api`.
</Warning>

## Personal Access Tokens

These are well-suited to cases where the user themselves issues an API token without going through the full OAuth2 flow.

```shell theme={null}
php artisan passport:client --personal
```

```php theme={null}
$token = $request->user()->createToken('cli-token', ['orders:read'])->accessToken;
```

<Info>
  If Personal Access Tokens are your primary use case, Laravel itself officially recommends considering Sanctum.
</Info>

## Related links

* [Laravel official documentation: Passport](https://laravel.com/docs/13.x/passport)
* [Laravel official documentation: Sanctum](https://laravel.com/docs/13.x/sanctum)


## Related topics

- [Laravel Sanctum (API Token Authentication)](/en/sanctum.md)
- [Socialite for Discord](/en/packages/socialite-discord.md)
- [Socialite (LINE Login) - LINE SDK for Laravel](/en/packages/laravel-line-sdk/socialite.md)
- [LINE SDK for Laravel](/en/packages/laravel-line-sdk/index.md)
- [Building an MCP Server with Laravel](/en/advanced/mcp-server.md)