---
title: "Owners & key types — Refresh Tokens for Laravel | Roundly"
description: "Polymorphic owners: users, API clients and admins share one table, isolated by morph class and key, on bigint, UUID or ULID keys."
url: https://roundly-consulting.com/open-source/docs/refresh-tokens-for-laravel/owners
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Refresh Tokens for Laravel](https://roundly-consulting.com/open-source/docs/refresh-tokens-for-laravel.md)

# Owners & key types

Every token row carries owner\_type (the owner’s morph class) and owner\_id, with a composite index. Owner-scoped queries — listing, revoking, family inheritance, session lookup — always match both, so user #7 and client #7 never see each other’s sessions:

```php
use RoundlyConsulting\RefreshTokens\Facades\RefreshTokens;

$user = User::find(7);
$client = Client::find(7);

RefreshTokens::sessions($user)->all();    // only User #7's sessions
RefreshTokens::sessions($client)->all();  // only Client #7's sessions — the ids never collide
```

owner\_type respects your morph map, so you can store short aliases instead of class names:

```php
use Illuminate\Database\Eloquent\Relations\Relation;

// owner_type stores the morph class, so your morph map is respected:
Relation::morphMap([
    'user' => \App\Models\User::class,
    'client' => \App\Models\Client::class,
]);
```

## Key type

The owner\_id column matches your owner models’ primary key. Set key\_type before the first migration:

- bigint (default) — the usual auto-incrementing integer column.
- uuid — for UUID-keyed owner models.
- ulid — for ULID-keyed owner models.

All owner models must share that key type — a bigint User and a uuid Client cannot share one table. owner\_id is the model key (getKey()), resolved like any Eloquent morph, not the auth identifier. Any other key\_type value throws InvalidConfigurationException naming the key and the value — including id, the package’s former spelling; use bigint.

## Guard-scoped redemption

When one app runs several sign-ins, each refresh endpoint can accept only its own owner type. A token of another type is treated as unknown — it is not consumed and never counts as reuse. See Redeeming & rotating for the details.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/refresh-tokens-for-laravel.md)