HTTP API

Balík obsahuje voliteľné JSON endpointy pre každý guard. Zaregistrujete ich cez routes.enabled = true pre guard, alebo explicitne:

// routes/api.php
use RoundlyConsulting\Auth\Facades\Authentication;

Authentication::routes('users');                                      // defaults

Authentication::routes('clients')
    ->prefix('api/clients/auth')
    ->name('clients.auth.')
    ->middleware(['api'])
    ->authenticatedMiddleware(['authentication.active'])
    ->except(['registration', 'invitations.manage']);

RouteRegistrar ponúka prefix(), name(), middleware(), authenticatedMiddleware(), only() a except(); routy zaregistruje pri deštrukcii. Predvolené: prefix {guard}/auth, názvy authentication.{guard}.*, middleware api. Dvojitá registrácia guardu vyhodí výnimku. Skupiny pre only() / except(): login, challenge, tokens, registration, invitations, passwords, email, account, sessions, two-factor, passkeys, invitations.manage.

Endpointy

Každá routa má authentication.guard:{guard} a Cache-Control: no-store a existuje len vtedy, ak je jej funkcia pre guard zapnutá (vypnutá funkcia vráti 404). Tokeny vždy putujú v tele požiadavky (JSON). * = vyžaduje prihlásenie (auth:{laravel_guard}); ? = nepovinné.

Každý endpoint, ktorý prihlasuje, prijíma aj device_name? (zobrazí sa v zozname relácií); register a invitations/accept navyše timezone? (uloží sa k novému účtu). Zariadenie sa číta z hlavičky X-Device-Id (activity.new_device.header), jazyk z X-Locale / Accept-Language. credential je JSON objektu PublicKeyCredential z prehliadača s členmi v base64url, doplnený o ceremonyId options, na ktoré odpovedá.

Odpovede

// 200 — authenticated
{ "status": "authenticated", "token_type": "Bearer", "access_token": "eyJ…", "expires_in": 900,
  "expires_at": "2026-09-26T10:15:00Z", "refresh_token": "…", "refresh_expires_at": "2026-10-26T10:00:00Z",
  "session_id": "0199…" }

// 200 — challenge
{ "status": "challenge", "challenge_token": "…", "expires_at": "…", "attempts_left": 5, "method": "password",
  "completed": [], "remaining": [ { "step": "second_factor", "methods": ["totp", "recovery_code", "passkey"] } ] }

// 202 — enumeration-safe acknowledgement (magic link, email code, forgot, resend, email change)
{ "status": "sent" }

// error
{ "message": "…", "code": "invalid_credentials", "errors": { "identifier": ["…"] } }

Odpovede na zmenu prihlasovacích údajov (PUT password, POST two-factor/confirm, DELETE two-factor, POST two-factor/recovery-codes, POST passkeys, DELETE passkeys/{passkey}) obsahujú tokens alebo null. Ak nie je null, klient musí okamžite prejsť na nový pár — jeho predošlý prístupový token so zmenou zanikol.

Chyby