IP-restricted write keys

composer require langsys/laravel-api-keys

PHP 8.2+ Laravel 10 / 11 / 12

A third key type, ip_write, reads from anywhere but writes only from an allow-listed address. It lets one key ship into client code — read-only to the public — while trusted networks (office or VPN egress, a partner’s servers) can still write.

$key = ApiKey::create([
    'name' => 'field-app',
    'type' => 'ip_write',
    'ip_allowlist' => ['203.0.113.0/24', '2001:db8::/32', '198.51.100.7'],
]);

Entries are exact IPv4/IPv6 addresses or CIDR ranges. Matching fails closed: an unparseable address, a malformed entry, a mismatched address family, or an empty allow-list all deny the write. A /0 prefix is rejected outright — as an allow-list entry it would authorise every address, which is never intended.

A malformed entry silently never matches, so it is rejected when you save the key rather than 403-ing mysteriously later:

ApiKey::create(['name' => 'oops', 'type' => 'ip_write', 'ip_allowlist' => ['nonsense']]);
// InvalidArgumentException: Invalid ip_allowlist entry [nonsense]…

An empty allow-list is permitted. It looks like a key that can never write, but extraWriteAllowances() (see Extending the model) exists so an application can authorise writes by means this package knows nothing about — device attestation, a signed grant — and an attestation-only key legitimately has no addresses at all. The package cannot know whether another path exists, so it does not guess.

Feedback