{"id":49934,"date":"2025-07-03T07:44:42","date_gmt":"2025-07-03T07:44:42","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49934"},"modified":"2025-07-03T07:45:30","modified_gmt":"2025-07-03T07:45:30","slug":"artisan-tutorials-php-artisan-passport","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/artisan-tutorials-php-artisan-passport\/","title":{"rendered":"artisan Tutorials: php artisan passport"},"content":{"rendered":"\n

When you run php artisan passport:install<\/code>, Laravel attempts to do the following:<\/p>\n\n\n\n

    \n
  1. Generate encryption keys (oauth-public.key<\/code> and oauth-private.key<\/code>).<\/li>\n\n\n\n
  2. Publish Passport\u2019s migrations if not already present.<\/li>\n\n\n\n
  3. Run those migrations (if you choose \u201cyes\u201d).<\/li>\n\n\n\n
  4. Create the default OAuth clients (Personal and Password).<\/li>\n<\/ol>\n\n\n\n

    Running php artisan passport:install<\/code> is a crucial setup step<\/strong> when using Laravel Passport for API authentication. Here’s a full explanation of why it’s needed<\/strong> and what it does:<\/p>\n\n\n\n

    \n\n\n\n

    \u2705 Why Run php artisan passport:install<\/code>?<\/h2>\n\n\n\n

    \ud83d\udd27 1. Generates Encryption Keys<\/strong><\/h3>\n\n\n\n
      \n
    • Laravel Passport uses encryption<\/strong> to securely issue and validate access tokens.<\/li>\n\n\n\n
    • passport:install<\/code> generates:\n
        \n
      • A private key<\/strong>: used to sign access tokens.<\/li>\n\n\n\n
      • A public key<\/strong>: used to verify the tokens on future requests.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n

        \ud83d\udcc1 These keys are stored in:<\/p>\n\n\n

        storage\/oauth-private<\/span>.key\nstorage\/oauth-public<\/span>.key\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n
        \ud83d\udd10 These keys are essential for the security of your API tokens.<\/p>\n<\/blockquote>\n\n\n\n
        \n\n\n\n
        \ud83c\udfab 2. Creates OAuth Clients<\/strong><\/h3>\n\n\n\n
        It automatically creates two default OAuth2 clients<\/strong> in the oauth_clients<\/code> table:<\/p>\n\n\n\n
        a. Personal Access Client<\/strong><\/h4>\n\n\n\n
          \n
        • Used when issuing tokens via $user->createToken('token-name')<\/code>.<\/li>\n\n\n\n
        • Good for first-party apps or backend-only workflows.<\/li>\n<\/ul>\n\n\n\n
          b. Password Grant Client<\/strong><\/h4>\n\n\n\n
            \n
          • Used for username\/password login<\/strong> via the \/oauth\/token<\/code> route.<\/li>\n\n\n\n
          • Commonly used in mobile apps and SPAs (single-page apps).<\/li>\n<\/ul>\n\n\n\n
            \n
            These clients have a unique Client ID and Client Secret<\/strong>, which are used to obtain tokens programmatically.<\/p>\n<\/blockquote>\n\n\n\n
            \n\n\n\n
            \ud83d\udd0d What Happens Behind the Scenes?<\/h2>\n\n\n\n
            When you run:<\/p>\n\n\n
            php<\/span> artisan<\/span> passport<\/span>:install<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
            Laravel does the following:<\/p>\n\n\n\n
              \n
            1. Generates oauth-public.key<\/code> and oauth-private.key<\/code>.<\/li>\n\n\n\n
            2. Creates one Personal Access Client<\/strong>.<\/li>\n\n\n\n
            3. Creates one Password Grant Client<\/strong>.<\/li>\n\n\n\n
            4. Stores all client data in the oauth_clients<\/code> table.<\/li>\n\n\n\n
            5. Outputs the client IDs and secrets in the console.<\/li>\n<\/ol>\n\n\n\n
              \n\n\n\n
              \ud83d\udccc When Should You Run It?<\/h2>\n\n\n\n
                \n
              • \u2705 When setting up Laravel Passport for the first time.<\/li>\n\n\n\n
              • \ud83d\udd01 When you accidentally delete the keys or clients.<\/li>\n\n\n\n
              • \ud83d\udee0\ufe0f When migrating environments (you might need to re-run with --force<\/code>).<\/li>\n<\/ul>\n\n\n\n
                \n\n\n\n
                \u26a0\ufe0f Tip:<\/h2>\n\n\n\n
                If you already have keys and clients<\/strong>, and re-running the command causes issues, use the --force<\/code> flag only if you’re resetting the environment<\/strong>:<\/p>\n\n\n
                php<\/span> artisan<\/span> passport<\/span>:install<\/span> --force<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                \n
                \u26a0\ufe0f Be careful: this will overwrite existing keys and may invalidate current tokens.<\/p>\n<\/blockquote>\n\n\n\n
                \n\n\n\n
                \u2705 Summary<\/h2>\n\n\n\n
                Action<\/th>Purpose<\/th><\/tr><\/thead>
                Generate OAuth keys<\/td>Sign and verify secure access tokens<\/td><\/tr>
                Create Personal Access Client<\/td>Issue tokens using createToken()<\/code> method<\/td><\/tr>
                Create Password Grant Client<\/td>Enable login via \/oauth\/token<\/code><\/td><\/tr>
                Store keys and clients<\/td>In storage\/<\/code> and oauth_clients<\/code> table<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                \n\n\n\n
                Here\u2019s a clear explanation of the difference between a Personal Access Client and a Password Grant Client<\/strong> in Laravel Passport:<\/p>\n\n\n\n
                \n\n\n\n
                \ud83d\udd11 1. Personal Access Client<\/strong><\/h3>\n\n\n\n
                \u2705 Purpose:<\/h4>\n\n\n\n
                Used when users authenticate via a token directly<\/strong>, usually through first-party apps<\/strong> (like your own web or mobile app). Ideal for issuing long-lived personal tokens<\/strong>.<\/p>\n\n\n\n
                \ud83d\udccc How it works:<\/h4>\n\n\n\n
                  \n
                • The user logs in through a traditional session (browser or API).<\/li>\n\n\n\n
                • The server generates a personal access token<\/strong> for the user using the createToken()<\/code> method: $token = $user->createToken('Token Name')->accessToken;<\/code><\/li>\n\n\n\n
                • No client credentials (ID\/secret) are required on the frontend.<\/li>\n<\/ul>\n\n\n\n
                  \ud83d\udd10 Use Case:<\/h4>\n\n\n\n
                    \n
                  • Admin panels<\/li>\n\n\n\n
                  • First-party web or mobile apps<\/li>\n\n\n\n
                  • API testing via Postman<\/li>\n<\/ul>\n\n\n\n
                    \ud83d\udd04 Token Flow:<\/h4>\n\n\n\n
                    User logs in \u2192 backend creates personal token \u2192 returns to frontend.<\/p>\n\n\n\n
                    \n\n\n\n
                    \ud83d\udd10 2. Password Grant Client<\/strong><\/h3>\n\n\n\n
                    \u2705 Purpose:<\/h4>\n\n\n\n
                    Used when you want the user to provide email\/password<\/strong> via API and obtain an access token programmatically<\/strong>. Often used by mobile apps or single-page apps<\/strong> (SPA).<\/p>\n\n\n\n
                    \ud83d\udccc How it works:<\/h4>\n\n\n\n
                      \n
                    • The client app sends a request to the \/oauth\/token<\/code> endpoint: POST \/oauth\/token Content-Type: application\/json { \"grant_type\": \"password\", \"client_id\": \"8\", \"client_secret\": \"your-password-client-secret\", \"username\": \"user@example.com\", \"password\": \"secret\", \"scope\": \"*\" }<\/code><\/li>\n\n\n\n
                    • If valid, Passport issues an access token.<\/li>\n<\/ul>\n\n\n\n
                      \ud83d\udd10 Use Case:<\/h4>\n\n\n\n
                        \n
                      • Mobile apps logging in users<\/li>\n\n\n\n
                      • SPAs with direct login forms<\/li>\n<\/ul>\n\n\n\n
                        \ud83d\udd04 Token Flow:<\/h4>\n\n\n\n
                        Frontend (mobile\/web) sends user credentials + client credentials \u2192 gets token from \/oauth\/token<\/code>.<\/p>\n\n\n\n
                        \n\n\n\n
                        \u2705 Summary Table<\/h3>\n\n\n\n
                        Feature<\/th>Personal Access Client<\/th>Password Grant Client<\/th><\/tr><\/thead>
                        Authentication<\/td>Server-side only<\/td>User credentials via API<\/td><\/tr>
                        Use Case<\/td>First-party web\/mobile<\/td>Mobile apps \/ SPAs<\/td><\/tr>
                        Client ID\/Secret Needed?<\/td>\u274c No<\/td>\u2705 Yes<\/td><\/tr>
                        Example Method<\/td>$user->createToken()<\/code><\/td>\/oauth\/token<\/code> endpoint with credentials<\/td><\/tr>
                        User Interaction<\/td>Already logged in via session<\/td>Login via email\/password in the app<\/td><\/tr>
                        Security Consideration<\/td>Tokens created securely server-side<\/td>Password passed through API (use HTTPS)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                        \n\n\n\n
                        <\/p>\n","protected":false},"excerpt":{"rendered":"
                        When you run php artisan passport:install, Laravel attempts to do the following: Running php artisan passport:install is a crucial setup step when using Laravel Passport for API authentication. Here’s a… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-49934","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49934"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49934\/revisions"}],"predecessor-version":[{"id":49936,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49934\/revisions\/49936"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}