PHPackages                             daniel-de-wit/lighthouse-sanctum - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. daniel-de-wit/lighthouse-sanctum

ActiveLibrary[Authentication & Authorization](/categories/authentication)

daniel-de-wit/lighthouse-sanctum
================================

Laravel Sanctum support for Laravel Lighthouse.

4.1.0(4mo ago)61128.3k↓26.6%8[5 issues](https://github.com/daniel-de-wit/lighthouse-sanctum/issues)[1 PRs](https://github.com/daniel-de-wit/lighthouse-sanctum/pulls)MITPHPPHP ^8.2CI failing

Since Apr 27Pushed 4mo ago3 watchersCompare

[ Source](https://github.com/daniel-de-wit/lighthouse-sanctum)[ Packagist](https://packagist.org/packages/daniel-de-wit/lighthouse-sanctum)[ Docs](https://github.com/daniel-de-wit/lighthouse-sanctum)[ RSS](/packages/daniel-de-wit-lighthouse-sanctum/feed)WikiDiscussions master Synced 1w ago

READMEChangelog (10)Dependencies (32)Versions (19)Used By (0)

Lighthouse Sanctum
==================

[](#lighthouse-sanctum)

[![Software License](https://camo.githubusercontent.com/074b89bca64d3edc93a1db6c7e3b1636b874540ba91d66367c0e5e354c56d0ea/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d627269676874677265656e2e737667)](LICENSE.md)[![Tests](https://github.com/daniel-de-wit/lighthouse-sanctum/actions/workflows/tests.yml/badge.svg)](https://github.com/daniel-de-wit/lighthouse-sanctum/actions/workflows/tests.yml)[![Coverage Status](https://camo.githubusercontent.com/0a01284bdface4ae11fabe1f1d68e699b18052fb52c439bc929a945b92c7f905/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f64616e69656c2d64652d7769742f6c69676874686f7573652d73616e6374756d2f62616467652e7376673f6272616e63683d6d6173746572)](https://coveralls.io/github/daniel-de-wit/lighthouse-sanctum?branch=master)[![PHPStan](https://camo.githubusercontent.com/441b5874ce4df0a2defc892979c96c46889b69cb32119d04f0b48626349f8bc9/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d656e61626c65642d627269676874677265656e2e7376673f7374796c653d666c6174)](https://github.com/phpstan/phpstan)[![Latest Version on Packagist](https://camo.githubusercontent.com/328b2693a16d2d256448616b9c4c8b840c6d7e378b09212a1114266a0b9e5bc0/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f64616e69656c2d64652d7769742f6c69676874686f7573652d73616e6374756d2e737667)](https://packagist.org/packages/daniel-de-wit/lighthouse-sanctum)[![Total Downloads](https://camo.githubusercontent.com/a46b39967f5339c054fb44acaa477f67a35ad90bb6850a2b46ad27a6790be339/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f64616e69656c2d64652d7769742f6c69676874686f7573652d73616e6374756d2e737667)](https://packagist.org/packages/daniel-de-wit/lighthouse-sanctum)

Add [Laravel Sanctum](https://github.com/laravel/sanctum) support to [Lighthouse](https://github.com/nuwave/lighthouse)

- [Requirements](#requirements)
- [Installation](#installation)
- [Usage](#usage)
    - [Login](#login)
    - [Logout](#logout)
    - [Register](#register)
    - [Email Verification](#email-verification)
    - [Forgot Password](#forgot-password)
    - [Reset Password](#reset-password)
- [Custom Identification](#custom-identification)

Requirements
------------

[](#requirements)

- [laravel/sanctum:^3.0 || ^4.0](https://github.com/laravel/sanctum)
- [nuwave/lighthouse:^6](https://github.com/nuwave/lighthouse)

Installation
------------

[](#installation)

#### 1. Install using composer:

[](#1-install-using-composer)

```
composer require daniel-de-wit/lighthouse-sanctum
```

#### 2. Publish configuration and schema

[](#2-publish-configuration-and-schema)

```
php artisan vendor:publish --tag=lighthouse-sanctum
```

#### 3. Import the published schema into your main GraphQL schema (`./graphql/schema.graphql`)

[](#3-import-the-published-schema-into-your-main-graphql-schema-graphqlschemagraphql)

```
type Query
type Mutation

#import sanctum.graphql
```

#### 4. HasApiTokens

[](#4-hasapitokens)

Apply the `Laravel\Sanctum\HasApiTokens` trait to your Authenticatable model as [described in the Laravel Sanctum documentation](https://laravel.com/docs/8.x/sanctum#issuing-api-tokens).

```
use Illuminate\Auth\Authenticatable;
use Laravel\Sanctum\Contracts\HasApiTokens as HasApiTokensContract;
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable implements HasApiTokensContract
{
    use HasApiTokens;
}
```

#### 5. Configuration

[](#5-configuration)

This package relies on [API Token Authentication](https://laravel.com/docs/8.x/sanctum#api-token-authentication), which uses stateless Bearer tokens to authenticate requests.

By default, [Laravel Sanctum](https://laravel.com/docs/8.x/sanctum) assumes that requests made from localhost should use the stateful [Spa Authentication](https://laravel.com/docs/8.x/sanctum#spa-authentication) instead. To disable this behaviour, remove any lines within the stateful section of your sanctum configuration:

```
// File: ./config/sanctum.php

    /*
    |--------------------------------------------------------------------------
    | Stateful Domains
    |--------------------------------------------------------------------------
    |
    | Requests from the following domains / hosts will receive stateful API
    | authentication cookies. Typically, these should include your local
    | and production domains which access your API via a frontend SPA.
    |
    */

    'stateful' => [
        // Remove entries here
    ],
```

Make sure the following middleware is enabled for Lighthouse:

```
// File: ./config/lighthouse.php
    'middleware' => [
        ...

        \Nuwave\Lighthouse\Support\Http\Middleware\AttemptAuthentication::class,

        ...
    ],
```

Configure Lighthouse to use the Sanctum guard:

```
// File: ./config/lighthouse.php
    /*
    |--------------------------------------------------------------------------
    | Authentication Guard
    |--------------------------------------------------------------------------
    |
    | The guard to use for authenticating GraphQL requests, if needed.
    | This setting is used whenever Lighthouse looks for an authenticated user, for example in directives
    | such as `@guard` and when applying the `AttemptAuthentication` middleware.
    |
    */

    'guard' => 'sanctum',
```

Usage
-----

[](#usage)

- [Login](#login)
- [Logout](#logout)
- [Register](#register)
- [Email Verification](#email-verification)
- [Resend Email Verification Link](#resend-email-verification-link)
- [Forgot Password](#forgot-password)
- [Reset Password](#reset-password)
- [Update Password](#update-password)

### Login

[](#login)

Authenticate the user to receive a Bearer token.

```
mutation {
    login(input: {
        email: "john.doe@gmail.com"
        password: "secret"
    }) {
        token
    }
}
```

Apply the Authorization header on subsequent calls using the token

```
  "Authorization": "Bearer 1|lJo1cMhrW9tIUuGwlV1EPjKnvfZKzvgpGgplbwX9"
```

(Using something other than email? See [Custom Identification](#custom-identification))

### Logout

[](#logout)

Revoke the current token.

```
mutation {
    logout {
        status
        message
    }
}
```

### Register

[](#register)

Successfully registering a user will immediately yield a bearer token (unless email verification is required).

```
mutation {
    register(input: {
        name: "John Doe"
        email: "john.doe@gmail.com"
        password: "secret"
        password_confirmation: "secret"
    }) {
        token
        status
    }
}
```

☝️ **Want to disable password confirmation?** Update your schema

[![](https://user-images.githubusercontent.com/3015394/116370867-1c6dda00-a80b-11eb-8fc4-e51166faa883.png)](https://user-images.githubusercontent.com/3015394/116370867-1c6dda00-a80b-11eb-8fc4-e51166faa883.png)

When registering a user in combination with the `MustVerifyEmail` contract you can optionally define the url for email verification. Both `__ID__` and `__HASH__` will be replaced with the proper values. When `use_signed_email_verification_url` is enabled in the configuration, the placeholders `__EXPIRES__` and `__SIGNATURE__` will be replaced.

```
mutation {
    register(input: {
        name: "John Doe"
        email: "john.doe@gmail.com"
        password: "secret"
        password_confirmation: "secret"
        verification_url: {
            url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__"
# Signed:   url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__&expires=__EXPIRES__&signature=__SIGNATURE__"
        }
    }) {
        token
        status
    }
}
```

### Email Verification

[](#email-verification)

The verification\_url provided at `register` or `resendEmailVerification` contains the `id` and `hash` for the mutation:

```
mutation {
  verifyEmail(input: {
    id: "1"
    hash: "af269947ed80d4a7bc3f78a6dfd05ec369373f9d"
  }) {
    status
  }
}
```

When `use_signed_email_verification_url` is enabled in the configuration, the input requires two additional fields.

```
mutation {
  verifyEmail(input: {
    id: "1"
    hash: "af269947ed80d4a7bc3f78a6dfd05ec369373f9d"
    expires: 1619775828
    signature: "e923636f1093c414aab39f846e9d7a372beefa7b628b28179197e539c56aa0f0"
  }) {
    status
  }
}
```

### Resend Email Verification Link

[](#resend-email-verification-link)

Use default Laravel email verification notification.

```
mutation {
    resendEmailVerification(input: {
        email: "john.doe@gmail.com",
    }) {
        status
    }
}
```

Or use the custom verification flow by uncommenting the `verification_url` argument within the `ResendEmailVerificationInput`:

```
input ResendEmailVerificationInput {
    email: String! @rules(apply: ["email"])
    verification_url: VerificationUrlInput!
}
```

Example mutation:

```
mutation {
    resendEmailVerification(input: {
        email: "john.doe@gmail.com",
         verification_url: {
             url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__"
             # or use signed url:
             # url: "https://my-front-end.com/verify-email?id=__ID__&token=__HASH__&expires=__EXPIRES__&signature=__SIGNATURE__"
        }
    }) {
        status
    }
}
```

### Forgot Password

[](#forgot-password)

Sends a reset password notification.

Optionally use custom reset url using both `__EMAIL__` and `__TOKEN__` placeholders.

```
mutation {
    forgotPassword(input: {
        email: "john.doe@gmail.com"
        reset_password_url: {
            url: "https://my-front-end.com/reset-password?email=__EMAIL__&token=__TOKEN__"
        }
    }) {
        status
        message
    }
}
```

### Reset Password

[](#reset-password)

Reset the user's password.

```
mutation {
    resetPassword(input: {
        email: "john.doe@gmail.com",
        token: "af269947ed80d4a7bc3f78a6dfd05ec369373f9d"
        password: "secret"
        password_confirmation: "secret"
    }) {
        status
        message
    }
}
```

☝️ **Want to disable password confirmation?** Update your schema

[![](https://user-images.githubusercontent.com/3015394/116374360-8045d200-a80e-11eb-891b-c9395d4e91a0.png)](https://user-images.githubusercontent.com/3015394/116374360-8045d200-a80e-11eb-891b-c9395d4e91a0.png)

### Update Password

[](#update-password)

Updates the current user's password.

```
mutation {
    updatePassword(input: {
        current_password: "mypass",
        password: "secret",
        password_confirmation: "secret"
    }) {
        status
    }
}
```

### Custom Identification

[](#custom-identification)

You can customize which fields are used for authenticating users.

For example, using `username` instead of the default `email`.

```
/*
|--------------------------------------------------------------------------
| Identification
|--------------------------------------------------------------------------
|
| Configure the credential fields by which the user will be identified.
| Default: email
*/

'user_identifier_field_name' => 'username',
```

Update the GraphQL schema accordingly

```
input LoginInput {
    username: String! @rules(apply: ["required"])
}
```

Docker
------

[](#docker)

Develop locally using [Docker](https://www.docker.com/) & [Docker Compose](https://docs.docker.com/compose/).

#### Setup

[](#setup)

This will build the Docker image and prepare the container.

```
make setup
```

- CLI: `make app`
- Destroy: `make destroy`

#### CLI

[](#cli)

Enter the container with shell to start developing.

```
make app
```

#### Destroy

[](#destroy)

Shutdown and remove the container.

```
make app
```

Testing
-------

[](#testing)

```
composer test
```

Coverage
--------

[](#coverage)

```
composer coverage
```

Static Analysis
---------------

[](#static-analysis)

```
composer analyze
```

Contributing
------------

[](#contributing)

Please see [CONTRIBUTING](CONTRIBUTING.md) for details.

Credits
-------

[](#credits)

- [Daniel de Wit](https://github.com/daniel-de-wit)
- [wimski](https://github.com/wimski)
- [All Contributors](../../contributors)

License
-------

[](#license)

The MIT License (MIT). Please see [License File](LICENSE.md) for more information.

###  Health Score

57

—

FairBetter than 98% of packages

Maintenance73

Regular maintenance activity

Popularity46

Moderate usage in the ecosystem

Community19

Small or concentrated contributor base

Maturity74

Established project with proven stability

 Bus Factor1

Top contributor holds 63.8% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~112 days

Recently: every ~284 days

Total

17

Last Release

141d ago

Major Versions

1.4.0 → 2.0.02022-03-06

2.3.0 → 3.0.02023-05-09

3.1.0 → 4.0.02025-04-07

PHP version history (5 changes)1.0.0PHP ^7.4 || ^8.0

2.0.0PHP ^8.0.2

2.3.0PHP ^8.0.2 || ^8.1.0 || ^8.2.0

3.0.0PHP ^8.1

4.0.0PHP ^8.2

### Community

Maintainers

![](https://www.gravatar.com/avatar/280a3fc65bcb018cdda3598076ca8040dbe6786970b2317d14d6f5f61d50a6c5?d=identicon)[daniel-de-wit](/maintainers/daniel-de-wit)

![](https://avatars.githubusercontent.com/u/12373573?v=4)[Wim Reckman](/maintainers/wimski)[@wimski](https://github.com/wimski)

---

Top Contributors

[![daniel-de-wit](https://avatars.githubusercontent.com/u/3015394?v=4)](https://github.com/daniel-de-wit "daniel-de-wit (111 commits)")[![wimski](https://avatars.githubusercontent.com/u/12373573?v=4)](https://github.com/wimski "wimski (59 commits)")[![czim](https://avatars.githubusercontent.com/u/11831617?v=4)](https://github.com/czim "czim (1 commits)")[![laravel-shift](https://avatars.githubusercontent.com/u/15991828?v=4)](https://github.com/laravel-shift "laravel-shift (1 commits)")[![mvdstam](https://avatars.githubusercontent.com/u/7629384?v=4)](https://github.com/mvdstam "mvdstam (1 commits)")[![xorinzor](https://avatars.githubusercontent.com/u/4212335?v=4)](https://github.com/xorinzor "xorinzor (1 commits)")

---

Tags

lighthouselaravel-sanctumlighthouse-sanctum

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan, Rector

Code StyleLaravel Pint

### Embed Badge

![Health badge](/badges/daniel-de-wit-lighthouse-sanctum/health.svg)

```
[![Health](https://phpackages.com/badges/daniel-de-wit-lighthouse-sanctum/health.svg)](https://phpackages.com/packages/daniel-de-wit-lighthouse-sanctum)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3345.4M354](/packages/psalm-plugin-laravel)[spatie/laravel-permission

Permission handling for Laravel 12 and up

13.0k107.5M1.6k](/packages/spatie-laravel-permission)[api-platform/laravel

API Platform support for Laravel

58190.1k21](/packages/api-platform-laravel)[fleetbase/core-api

Core Framework and Resources for Fleetbase API

1239.7k25](/packages/fleetbase-core-api)[laravel/cashier

Laravel Cashier provides an expressive, fluent interface to Stripe's subscription billing services.

2.6k31.8M162](/packages/laravel-cashier)[laravel/pulse

Laravel Pulse is a real-time application performance monitoring tool and dashboard for your Laravel application.

1.7k16.3M154](/packages/laravel-pulse)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)