Great question. Managing OAuth client ID and secret for Laravel Passport across 10 microservices can quickly become a pain if done manually.

❓ Your Challenge:

You want every microservice (MS) to:

Use Laravel Passport
Have PASSPORT_CLIENT_ID and PASSPORT_CLIENT_SECRET in their .env files
Avoid updating these manually across 10 services

✅ Recommended Solutions

✅ Option 1: Use a Central Auth Microservice (Best Practice)

Instead of having each microservice use Passport independently:

✅ Only one service (Auth Service) runs Laravel Passport.
❓ Other services just verify the token using jwt middleware or custom guards.

🔁 Microservices share only the public key for verifying the JWT token.

🔐 Workflow:

Auth service:
- Handles passport:install
- Issues and validates tokens
Other microservices:
- Use middleware to decode/verify token using shared oauth-public.key

🔧 Share the public key:

Store oauth-public.key in a shared NFS, AWS S3, or deploy-time asset.

✅ Option 2: Centralize Secrets in a Config Service or .env Templating

Instead of manually editing .env 10 times:

🔁 Method A: Use a `.env.template` and script

# .env.template
PASSPORT_CLIENT_ID={{client_id}}
PASSPORT_CLIENT_SECRET={{client_secret}}

Then use a script to inject actual values into each .env.

🔁 Method B: Store values centrally

Use:

HashiCorp Vault
AWS Secrets Manager
Laravel .env synchronizer tools
Private Gist or Git repo (private)

Each MS reads its client ID/secret from this shared config at runtime or on boot.

✅ Option 3: Laravel Env Sync Script

Create a Bash script to update all .env files automatically:

#!/bin/bash

CLIENT_ID="your_client_id"
CLIENT_SECRET="your_client_secret"

services=(
  "mhn-colleges-ms"
  "mhn-contact-ms"
  "mhn-core-ms"
  ...
)

for service in "${services[@]}"; do
  ENV_PATH="$service/.env"
  echo "Updating $ENV_PATH"
  sed -i "/PASSPORT_CLIENT_ID/c\PASSPORT_CLIENT_ID=$CLIENT_ID" "$ENV_PATH"
  sed -i "/PASSPORT_CLIENT_SECRET/c\PASSPORT_CLIENT_SECRET=$CLIENT_SECRET" "$ENV_PATH"
done

🔒 This approach assumes all microservices use the same client (e.g., shared password grant client).

✅ Option 4: Use `.env.shared` and include it

In each .env, do:

# .env
include .env.shared

Then manage only one .env.shared and symlink it during deployment.

Laravel doesn't support include natively, but you can load it using Dotenv::create() or a deployment script.

🚀 Summary Table

| Strategy | Manual Work | Scalable? | Best Use Case |
| ---------------------------- | ----------- | --------- | ----------------------------- |
| Manual update in .env | ❌ High | ❌ No | Not recommended |
| Central Auth service | ✅ Minimal | ✅ Yes | Ideal architecture |
| Env templating/scripts | ⚠️ Some | ✅ Yes | Good for monorepo |
| Shared secrets (.env.shared) | ✅ Minimal | ✅ Yes | Good for deployment pipelines |

Let me know your setup (monorepo or multi-repo), and I can generate a full automation script or CI/CD deployment trick for this.