Permissions

composer require langsys/laravel-api-keys Copy

PHP 8.2+ Laravel 10 / 11 / 12

Packagist ↗ GitHub ↗ Also: Access Guard

Keys are granted permissions by value (think OAuth scopes):

$key->grantPermissions(['view_projects', 'edit_projects']);
$key->hasPermission('view_projects'); // true
$key->revokePermissions('edit_projects');
$key->syncPermissions(['view_projects']);
$key->permissionValues();             // ['view_projects']

Permissions are stored once as rows in a shared permissions table (id, value, label) and referenced from api_key_has_permissions by permission_id. grantPermissions() creates any value that doesn’t exist yet, and revokePermissions() detaches the key without deleting the shared row.

This is deliberately the same table and shape that Access Guard uses for role and model permissions, so an application running both packages has one row per permission rather than one representation per package. Whichever package migrates first creates the table; the other skips it.

Anywhere a permission is accepted you may pass a value, a backed enum, or a Permission model:

$key->grantPermissions(Permission::create(['value' => 'ship_it']));
$key->hasPermission(MyPermission::ViewProjects);  // a BackedEnum
$key->hasPermission('view_projects');

Set default_permissions in the config to grant a baseline set to every new key.