Authenticating Laravel 8.6 API’s using jwt-auth & document with knuckleswtf /scribe
Tags: Jwt Token, Json Api, Jwt Auth, Laravel, Scribe

Laravel is a PHP framework that is used to develop web applications and application programming interfaces (API’s). Developing API’s for a web based or mobile application will require one to develop a security based authentication feature implying only registered users can gain access. In this article, the feature focus on the following API’s :- login, refresh token, forgot password, change password and logout. Third party packages used in the development are jwt-auth and scribe . Jwt-auth generates a jason web token while scribe facilitates documenting API’s.

Create a laravel project

Create a new Laravel 8.6 project by opening the command prompt (cmd or terminal) and change directory to your desired location for the project. i.e

cd /var/www/html/

Then run the command

composer create-project laravel/laravel my-app

Once the project created successfully, navigate the root of the application to locate the .env file to set the database connection. As of now, the assumption being one is using mysql or mariadb and has already created a database for the application in local machine. Locate the section below and DB_DATABASE, DB_USERNAME and DB_PASSWORD.

DB_CONNECTION=mysql

DB_HOST=127.0.0.1

DB_PORT=3306

DB_DATABASE=your_database

DB_USERNAME=your_database_username

DB_PASSWORD=your_database_password

Use composer to install third party packages — jwt-auth and scribe

Now, proceed with the installation of third party packages. In the open command prompt, change directory to that of the application if applications root directory not open on the command prompt.

cd my-app

Run the following command using composer to install jwt-auth.

composer require tymon/jwt-auth

Configure jwt-auth

Navigate to config folder in the the project’s root to access the app.php file. In the app.php file, locate providers and add jwt-auth provider as shown below. Copy Tymon\JWTAuth\Providers\LaravelServiceProvider::class, and paste in the providers array as illustrated.

'providers' => [



...other providers



Tymon\JWTAuth\Providers\LaravelServiceProvider::class,

]

2. A config file for jwt-auth is generated by running the following command.

php artisan vendor:publish --provider="Tymon\JWTAuth\Providers\LaravelServiceProvider"

3. Navigate to jwt.php file in config and make the following changes

'defaults' => [

'guard' => 'api',

'passwords' => 'users',

],



...



'guards' => [

'api' => [

'driver' => 'jwt',

'provider' => 'users',

],

],

4. The jwt-auth package is set; at this point a key needs generation using the command below. It will update the .env file.

php artisan jwt:secret

Once the installation is complete and through with configuration, do the same for scribe.

Install and configure scribe

Use the following command to install scribe.

composer require --dev knuckleswtf/scribe

Configure scribe

Publish scribe.php config file with the following command.

php artisan vendor:publish --provider="Knuckles\Scribe\ScribeServiceProvider" --tag=scribe-config

Run the following command to test if the installation works.

php artisan scribe:generate

NB: Naviagate to providers in the app folder and locate AppServiceProviders to make a few changes indicated as:

<?php namespace App\Providers; use Illuminate\Support\Facades\Schema;

use Illuminate\Support\ServiceProvider;

use Illuminate\Http\Resources\Json\JsonResource; class AppServiceProvider extends ServiceProvider

{

// other lines of code ommitted

public function boot()

{

JsonResource::withoutWrapping();

Schema::defaultStringLength('255');

}

}

The default string length increases the limit of the possible characters to store in a database table field. The without wrapping ensures response from API calls has no data wrapping around it.

configure the default user model in models/user.php to work with jwt-auth

The first thing is class User to implement the contract JWTSubject followed by implementing two methods from the contract. The implementation facilitates jwt-auth to work with the user model.

Ensure it has the following look as explained in documentation