Laravel token middleware
My take on this is the following:


rename the middleware to something meaningful (I took example from VerifyCsrfToken middleware)
throw exception if token is mismatched
rename checkToken to verify, reader of the code knows that code checks/verifies token because thats the point of the middleware 
simplify even more verify function and add docblock
optimize the query to the following


select exists(select `id` from `tokens` where (`client` = 'Android' and `token` = 'OuK0ELzYkN3Ss9Zf')) as `exists`




So ApiAccess becomes following:

&lt;?php

namespace App\Http\Middleware;

use App\Exceptions\TokenMismatchException;
use App\ApiToken;
use Closure;

class VerifyApiToken
{

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request $request
     * @param  \Closure                 $next
     *
     * @return mixed
     * @throws \App\Exceptions\TokenMismatchException
     */
    public function handle(Request $request, Closure $next)
    {
        if ($this-&gt;verify($request)) {
            return $next($request);
        }

        throw new TokenMismatchException;
    }


    /**
     * Verify token by querying database for existence of the client:token pair specified in headers.
     *
     * @param \Illuminate\Http\Request $request
     *
     * @return bool
     */
    public function verify($request): bool //optional return types
    {
        return ApiToken::select('id')-&gt;where([    // add select so Eloquent does not query for all fields
            'client' =&gt; $request-&gt;header('client'), // remove variable that is used only once
            'token'  =&gt; $request-&gt;header('token'),  // remove variable that is used only once
        ])-&gt;exists();
    }
}


Create new Exception, php artisan make:exception TokenMismatchException - yes kind of same as Laravel's stock one used when CSRF token is mismatched.

With body:

&lt;?php

namespace App\Exceptions;

use Exception;

class TokenMismatchException extends Exception
{

    /**
     * Report the exception.
     *
     * @return void
     */
    public function report()
    {
        //
    }


    /**
     * Render the exception into an HTTP response.
     *
     * @param  \Illuminate\Http\Request $request
     *
     * @return \Illuminate\Http\Response|null
     */
    public function render($request)
    {
        if ($request-&gt;wantsJson()) { // if request has `Accept: application/json` header present
            return response()-&gt;json(['error' =&gt; 'Unauthorized'], 403);
        }

        return abort(403);
    }
}



  Note: remove use function response; statements because helpers are auto-loaded from Laravel's helpers