README

Stripe-style typed API tokens with groups, environments, and audit logging for Laravel. Features conductor-based API, token rotation, revocation strategies, seamless Sanctum integration, and optional recoverable legacy tokens for systems that must display keys after creation.

Requirements

Requires PHP 8.5+ and Laravel 13+

Installation

composer require cline/bearer

If you want Bearer to delegate runtime ability checks to Warden, install Warden in your application and switch the authorization driver:

composer require cline/warden

// config/bearer.php
'authorization' => [
    'default' => env('BEARER_AUTHORIZATION_DRIVER', 'array'),
],

array remains the default provider. warden requires both the token's stored ability scope and the token owner's Warden permission to pass.

Bearer also honors the configured morph key map when hydrating token ownership relations. If your User, Organization, or other owner model uses ulid or uuid as its primary key, configure the relevant entry in morphKeyMap or enforceMorphKeyMap and Bearer will resolve owner, context, boundary, and the corresponding HasAccessTokensTrait relations correctly.

As of 6.0.0, the default bearer guard is stateless. Routes protected with auth:bearer authenticate only from bearer tokens. If you need the previous session-first behavior for first-party browser flows, register a guard that uses the stateful-bearer driver instead.

Documentation

• Getting Started - Installation, configuration, and first steps
• Basic Usage - Creating, validating, and managing tokens
• Authentication - Integrating with Laravel authentication
• Custom Token Types - Defining typed tokens with abilities
• Token Metadata - Attaching and querying token metadata
• Derived Keys - Hierarchical token derivation for resellers
• Revocation & Rotation - Token lifecycle management
• IP & Domain Restrictions - Network-based access control
• Rate Limiting - Throttling token usage
• Usage Tracking - Monitoring token activity
• Audit Logging - Recording token events
• Token Generators - Custom token generation strategies

Change log

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING and CODE_OF_CONDUCT for details.

Security

If you discover any security related issues, please use the GitHub security reporting form rather than the issue queue.

Credits

• Brian Faust
• All Contributors

License

The MIT License. Please see License File for more information.