Using with laravel-api-keys

composer require langsys/laravel-access-guard Copy

PHP 8.2+ Laravel 10 / 11 / 12

Packagist ↗ GitHub ↗ Also: API Keys

Install both packages and it just works — no subclassing, no contract to implement. When a key from API Keys authenticates, its middleware puts it on the request and Access Guard adapts it automatically: the key’s own permissions are checked, and it is authorized against an entity only if it has been linked to that entity.

Link keys to entities with the AuthorizesWithApiKeys trait:

use Langsys\AccessGuard\Concerns\AuthorizesWithApiKeys;
use Langsys\AccessGuard\Contracts\GuardableResource;

class Project extends Model implements GuardableResource
{
    use AuthorizesWithApiKeys;
}

$project->grantApiKey($apiKey);   // this key may now act on this project
$project->revokeApiKey($apiKey);

AccessGuard::authorize('edit_projects', $project) then passes for a key that both holds edit_projects and is linked to $project, and is denied otherwise. Linking is the one explicit step — it’s a security boundary — and it lives in the entity_has_api_keys pivot. Without api-keys installed, only the user path runs.

Other key systems: any object implementing AuthorizableByKey is used as-is. Point config('access-guard.api_key.bridge') at a different key class to auto-adapt it, or set it to null to turn the bridge off.