title: How to Implement OAuth correctly in API with Laravel Passport?
body: <p>I'm trying to create an <em>API</em> and use it in my own applications (web application and native mobile app) and make it available for third-party applications ( this is for future purposes).</p>
  <p>I've read the <a href="https://laravel.com/docs/6.x/passport" rel="noreferrer">Laravel Passport</a> documentation, and I have some doubts that hopefully someone could help me with it.</p>
  <p>As a developer, I always try to find the best and correct way to implement my projects and find the appropriate packages for the purposes of the projects.</p>
  <hr />
  <p><strong>Brief explanation of what I want to do:</strong></p>
  <p>I want to create an <em>API</em> and I will consume my own <em>API</em> in my web and mobile applications, my <em>API</em> has two endpoints for register and login for <strong>students</strong> and <strong>teachers</strong>. They can login with their email and password. Each user type has its own information. A teacher can have a <strong>CV</strong>, and students can see teachers' CV( the whole creating and reading <strong>CV's</strong> are handling in my API ), and they both user types can communicate with each other. I'm using <strong>laravel 6.x</strong> version to build my <em>API</em>. We have a section for developers in our subdomain which <strong>developers</strong> can register accounts and get/buy an <strong>access token</strong> to make requests to my API and use it, on the other hand, I want when students or teachers login to their accounts the <em>API</em> generates an <strong>access token</strong> for that user so then my application can use that token and pass that in every requests to make users be authenticated to access their private resources like their Dashboard as we know <em>API's</em> are stateless and we can't use sessions to store user credentials, so we need an access token for that.</p>
  <blockquote>
  <p>Can <strong>Laravel Passport</strong> generate the both <strong>Developer access token</strong>, and <strong>User( teacher or student) access token</strong>?<br />
  Is it correct to use <strong>OAuth</strong> in here to develop my <em>API</em>?
  Or can I just use <strong>tymondesigns/JWT</strong> package for these purposes?</p>
  </blockquote>
  <hr />
  <p>I have to say that I'm new to <strong>Oauth</strong> and <strong>API based applications</strong>. I've read some articles about <strong>Oauth</strong>, and I'm a little bit familiar with <strong>Oauth terminology</strong>, but still, I don't know how to implement this project correctly.</p>
  <p>So here are my questions:</p>
  <blockquote>
  <ol>
  <li>What is exactly <strong>Oauth server</strong>? Is it my own server that is hosted by <em>API</em>?</li>
  </ol>
  </blockquote>
  <p></p>
  <blockquote>
  <ol start="2">
  <li>After <strong>Laravel Passport</strong> configuration and database migration, <strong>Laravel Passport</strong> created some tables in my database, I would be really appreciated if you could tell me what is the purpose of each tables? table names are <strong>failed_jobs</strong>, <strong>oauth_access_tokens</strong>, <strong>oauth_auth_codes</strong>, <strong>oauth_clients</strong>,    <strong>oauth_personal_access_clients</strong>, <strong>oauth_refresh_tokens</strong>.</li>
  </ol>
  </blockquote>
  <p></p>
  <blockquote>
  <ol start="3">
  <li>I've configured my <strong>Laravel</strong> application to use the <strong>Laravel Passport</strong> and I created two <strong>Routes</strong> in my <strong>api.php</strong> file</li>
  </ol>
  </blockquote>
  <pre><code>Route::post('login','API\Auth\UserAuthController@login');
  Route::post('register','API\Auth\UserAuthController@register');
  </code></pre>
  <p>and then, I created the <code>UserAuthController.php</code> file and wrote the login and register methods. They are working without any problem. After a user registers or login into their account, my code will generate a <strong>personal access token</strong>.</p>
  <pre><code>$token = $user-&gt;createToken('authentication')-&gt;accessToken;
  </code></pre>
  <p>and then students or teachers can access to the private resources of their own with this <strong>access token</strong>. Is it right to create a <strong>personal access token</strong> for my two types of users? What is exactly a <strong>personal access token</strong>?<br />
  I just know you can pass it into request header, and the server will authorize you to access private resources. what I mean by private resources is the endpoints which are protected by <strong>API middleware</strong> like this:</p>
  <pre><code>Route::post('/update-info','API\Auth\UserAuthController@update')-&gt;middleware('auth:api');
  </code></pre>
  <p></p>
  <blockquote>
  <ol start="4">
  <li>Am I doing right to create a <strong>personal access token</strong> when teachers and students login to their account or I should do another way to handle it?! this way works, but I'm looking for correct way if there is anything else.</li>
  </ol>
  </blockquote>
  <p></p>
  <blockquote>
  <ol start="5">
  <li>The weird thing here is <strong>Laravel Passport</strong> create a token every time users login and it doesn't check if they have already created token or not? If someone can access the <code>API</code> endpoint, they can make a post request to /login endpoint and create a lot of tokens. Is it a problem? How to fix it?</li>
  </ol>
  </blockquote>
  <p></p>
  <blockquote>
  <ol start="6">
  <li>When I create a <strong>personal access token</strong> I need to pass an argument to <code>createToken($arg)</code> method, and it stores in <strong>oauth_personal_access_clients</strong> table. what is the purpose of this? Is it just for <strong>Laravel Passport</strong> purpose, or maybe I need it in the future?</li>
  </ol>
  </blockquote>
  <p></p>
  <blockquote>
  <ol start="7">
  <li>I have some endpoints which are not protected by <code>auth:api</code> <strong>middleware</strong>, for example, every user visit my application they can search for teachers name and lessons and ... , it's not necessary to make them login or register first. These endpoints are accessible to everyone in my application, and they are free to search and advance search for some information. My question is if I make it accessible to everyone, how can I <strong>protect</strong> these endpoints that <strong>only</strong> my <strong>first-party app</strong> and <strong>third-party app</strong> can access them. I mean I don't want people to access them by <strong>command line</strong> or <strong>postman</strong> or some kind of these tools without access token, I want to protect these endpoints from attackers not to make a huge requests to make my server down. How can I protect this kind of endpoints? I know I can <strong>limit requests</strong> per minute, but I don't know <strong>how much</strong> limit it? Is there any other way?</li>
  </ol>
  </blockquote>
  <p></p>
  <blockquote>
  <ol start="8">
  <li>I see there is a term called <strong>clients</strong> in <strong>Oauth terminology</strong>, as I understand <strong>clients</strong> are the applications like <strong>web applications</strong> or <strong>native mobile app</strong> and any other applications that use my API are called <strong>clients</strong>. Am I right? And I think this is for third-party application <strong>authentication</strong>. I'm a little bit confused after reading <strong>Laravel Passport</strong> documentation about <strong>clients</strong>, and when I configured the <strong>Laravel Passport</strong>, it generates <strong>two clients</strong> and stored them in database. Do I need to create a client for my Applications?! How Can I ignore authorization flow <strong>just</strong> for first-party applications?</li>
  </ol>
  </blockquote>
  <hr />
  <blockquote>
  <ol start="9">
  <li>After <strong>Laravel Passport</strong> configuration, now I can see it generates some default route for clients.</li>
  </ol>
  </blockquote>
  <pre><code>/oauth/clients
  /oauth/clients/{client-id}
  /oauth/authorize
  /oauth/token
  </code></pre>
  <p>What is the usage of these <strong>routes</strong>?! do I need them to create my <strong>first-party applications</strong>?</p>
  <hr />
  <blockquote>
  <ol start="10">
  <li>As I said the future purpose of this application is to make the API accessible by <strong>third-party applications</strong>, I have to create a web page that <strong>developers</strong> register an account and get/buy a <strong>token</strong> to access my API. is it possible to do it with <strong>Laravel Passport</strong> or I should write my own logic to make it work? Do I need to create a client for my third-party clients?</li>
  </ol>
  </blockquote>
  <p>Thanks a lot for your help &lt;3</p>