DEV Community: AL Mamon

Implementing Sign in with Apple in Laravel REST API

AL Mamon — Tue, 13 May 2025 03:55:11 +0000

To implement Sign in with Apple functionality in your Laravel REST API, you'll need to follow these steps:

Prerequisites

An Apple Developer account

A registered app in Apple Developer portal

Laravel 8.x or higher

PHP 7.4 or higher
Setup Apple Developer Configuration

Go to Apple Developer Portal

Create a new App ID with "Sign In with Apple" capability enabled

Note your Service ID (e.g., com.example.app)

Generate a private key for "Sign In with Apple" and download it
Install Required Packages

composer require laravel/socialite
composer require socialiteproviders/apple

Configuration

Add these to your .env file:

APPLE_CLIENT_ID=nz.co.fskills.app
APPLE_TEAM_ID=J43F88Y4BH
APPLE_KEY_ID=CLU5NYTK5P
APPLE_PRIVATE_KEY_PATH=storage/apple_private_key.pem

config/services.php

'apple' => [
  'client_id' => env('APPLE_CLIENT_ID'),
  'client_secret' => env('APPLE_CLIENT_SECRET'),
  'redirect' => env('APPLE_REDIRECT_URI')
],

Store the apple_private_key.pem in `storage/apple_private_key.pem`

-----BEGIN PRIVATE KEY-----
Example key
-----END PRIVATE KEY-----

Create an Controller :

public function SocialLogin(Request $request): \Illuminate\Http\JsonResponse
    {

        $request->validate([
            'token'    => 'required',
            'provider' => 'required|in:google,facebook,apple',
        ]);

        try {
            $provider   = $request->provider;
            $socialUser = Socialite::driver($provider)->stateless()->userFromToken($request->token);
            //return response()->json($socialUser);

            if ($socialUser) {
                $user      = User::withTrashed()->where('email', $socialUser->email)->first();
                if (!empty($user->deleted_at)) {
                    return Helper::jsonErrorResponse('Your account has been deleted.',410);
                }
                $isNewUser = false;

                if (!$user) {
                    $password = Str::random(16);
                    $user     = User::create([
                        'name'              => $socialUser->getName(),
                        'email'             => $socialUser->getEmail(),
                        'password'          => bcrypt($password),
                        'avatar'             => $socialUser->getAvatar(),
                        'email_verified_at' => now(),
                    ]);
                    $isNewUser = true;
                }

                Auth::login($user);
                $token = auth('api')->login($user);

                return response()->json([
                    'status'     => true,
                    'message'    => 'User logged in successfully.',
                    'code'       => 200,
                    'token_type' => 'bearer',
                    'token'      => $token,
                    'expires_in' => auth('api')->factory()->getTTL() * 60,
                    'data'       => $user,
                ],200);
            } else {
                return Helper::jsonResponse(false, 'Unauthorized', 401);
            }
        } catch (Exception $e) {
            return Helper::jsonResponse(false, 'Something went wrong', 500, ['error' => $e->getMessage()]);
        }
    }

Create a route:

Route::post('/social-login', [SocialLoginController::class, 'SocialLogin']);

Laravel 12 API Integration with Sanctum: Step-by-Step Guide

AL Mamon — Sat, 10 May 2025 13:56:13 +0000

Installation & Setup

Step 1: Install Laravel

composer create-project laravel/laravel example-app

This command creates a new Laravel project in the example-app directory.

Step 2: Install Sanctum

php artisan install:api

This installs Laravel Sanctum for API authentication. Note: In Laravel 12, you might need to install Sanctum separately with:
Step 3: Sanctum Configuration in migration file

composer require laravel/sanctum
php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

Database Configuration

Step 3: Migration Setup

The provided migration file extends the default Laravel user table with additional fields for:

<?php

use Illuminate\Support\Facades\Schema;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Database\Migrations\Migration;

return new class extends Migration
{
    /**
     * Run the migrations.
     */
    public function up(): void
    {
        Schema::create('users', function (Blueprint $table) {
            $table->id();
            $table->string('name');
            $table->string('email')->unique();
            $table->timestamp('email_verified_at')->nullable();
            $table->string('password');
            $table->string('otp')->nullable();
            $table->string('otp_created_at')->nullable();
            $table->boolean('is_otp_verified')->default(false);
            $table->timestamp('otp_expires_at')->nullable();
            $table->string('reset_password_token')->nullable();
            $table->timestamp('reset_password_token_expire_at')->nullable();
            $table->string('delete_token')->nullable();
            $table->timestamp('delete_token_expires_at')->nullable();
            $table->string('deleted_at')->nullable();
            $table->rememberToken();
            $table->timestamps();
        });

        Schema::create('password_reset_tokens', function (Blueprint $table) {
            $table->string('email')->primary();
            $table->string('token');
            $table->timestamp('created_at')->nullable();
        });

        Schema::create('sessions', function (Blueprint $table) {
            $table->string('id')->primary();
            $table->foreignId('user_id')->nullable()->index();
            $table->string('ip_address', 45)->nullable();
            $table->text('user_agent')->nullable();
            $table->longText('payload');
            $table->integer('last_activity')->index();
        });
    }

    /**
     * Reverse the migrations.
     */
    public function down(): void
    {
        Schema::dropIfExists('users');
        Schema::dropIfExists('password_reset_tokens');
        Schema::dropIfExists('sessions');
    }
};

Model Configuration

Step 4: User Model (app/Models/User.php)

The User model is configured with:

<?php

namespace App\Models;


use Laravel\Sanctum\HasApiTokens;
use Illuminate\Notifications\Notifiable;
use Illuminate\Database\Eloquent\SoftDeletes;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Database\Eloquent\Factories\HasFactory;

class User extends Authenticatable
{
use HasFactory, Notifiable,HasApiTokens,SoftDeletes;

    protected $guarded = ['id'];

    protected $hidden = [
        'password',
        'otp',
        'otp_expires_at',
        'email_verified_at',
        'reset_password_token',
        'reset_password_token_expire_at',
        'is_otp_verified',
        'created_at',
        'updated_at',
        'role',
        'status',
        'remember_token',
    ];

    /**
     * Get the attributes that should be cast.
     *
     * @return array<string, string>
     */
    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'otp_expires_at' => 'datetime',
            'is_otp_verified' => 'boolean',
            'reset_password_token_expires_at' => 'datetime',
            'password' => 'hashed'
        ];
    }

}

API Routes

Step 5: Route Configuration (routes/api.php)

api.php

<?php

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use App\Http\Controllers\API\Auth\LoginController;
use App\Http\Controllers\API\Auth\LogoutController;
use App\Http\Controllers\API\Auth\RegisterController;
use App\Http\Controllers\API\Auth\ResetPasswordController;


//register
Route::post('register', [RegisterController::class, 'register']);
Route::post('/verify-email', [RegisterController::class, 'VerifyEmail']);
Route::post('/resend-otp', [RegisterController::class, 'ResendOtp']);
//login
Route::post('login', [LoginController::class, 'login']);
//forgot password
Route::post('/forget-password', [ResetPasswordController::class, 'forgotPassword']);
Route::post('/verify-otp', [ResetPasswordController::class, 'VerifyOTP']);
Route::post('/reset-password', [ResetPasswordController::class, 'ResetPassword']);

Route::group(['middleware' => 'auth:sanctum'], static function () {
    Route::get('/refresh-token', [LoginController::class, 'refreshToken']);
    Route::post('/logout', [LogoutController::class, 'logout']);
});

Controller Implementation

RegisterController

Handles user registration and email verification:

<?php

namespace App\Http\Controllers\API\Auth;

use Exception;
use Carbon\Carbon;
use App\Models\User;
use App\Mail\OtpMail;
use App\Helpers\Helper;
use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\Validator;

class RegisterController extends Controller
{
    public function register(Request $request): \Illuminate\Http\JsonResponse
    {
        $request->validate([

            'name' => 'nullable|string|max:100',
            'email' => 'required|string|email|max:150|unique:users',
            'password' => 'required|string|min:8|confirmed',
        ]);
        try {
            $otp = random_int(1000, 9999);
            $otpExpiresAt = Carbon::now()->addMinutes(60);

            $user = User::create([

                'name' => $request->input('name'),
                'email' => $request->input('email'),
                'password' => Hash::make($request->input('password')),
                'otp' => $otp,
                'otp_expires_at' => $otpExpiresAt,
                'is_otp_verified' => false,
            ]);
            // Send OTP email
            Mail::to($user->email)->send(mailable: new OtpMail($otp, $user, 'Verify Your Email Address'));
            return response()->json([
                'status' => true,
                'message' => 'User successfully registered. Please verify your email to log in.',
                'code' => 201,
                'data' => $user
            ], 201);
        } catch (Exception $e) {
            return Helper::jsonErrorResponse('User registration failed', 500, [$e->getMessage()]);
        }
    }
    public function VerifyEmail(Request $request): \Illuminate\Http\JsonResponse
    {
        $request->validate([
            'email' => 'required|email|exists:users,email',
            'otp'   => 'required|digits:4',
        ]);
         try {
            $user = User::where('email', $request->input('email'))->first();

            // Check if email has already been verified
            if (!empty($user->email_verified_at)) {
                $user->is_verified = true;
                return Helper::jsonResponse(true, 'Email already verified.', 409);
            }

            if ((string)$user->otp !== (string)$request->input('otp')) {
                return Helper::jsonErrorResponse('Invalid OTP code', 422);
            }

            // Check if OTP has expired
            if (Carbon::parse($user->otp_expires_at)->isPast()) {
                return Helper::jsonErrorResponse('OTP has expired. Please request a new OTP.', 422);
            }
            $token = $user->createToken('YourAppName')->plainTextToken;
            // Verify the email
            $user->email_verified_at = now();
            $user->is_verified = true;
            $user->otp = null;
            $user->otp_expires_at = null;
            $user->save();
            return response()->json([
                'status' => true,
                'message' => 'Email verification successful.',
                'code' => 200,
                'token'      => $token,
                'data' => [
                    'id' => $user->id,
                    'email' => $user->email,
                    'name' => $user->name,
                    'is_verified' => $user->is_verified,
                ]
            ], 200);

         } catch (Exception $e) {
             return Helper::jsonErrorResponse($e->getMessage(), $e->getCode());
         }
    }

    public function ResendOtp(Request $request): \Illuminate\Http\JsonResponse
    {
        $request->validate([
            'email' => 'required|email|exists:users,email',
        ]);
        try {
            $user = User::where('email', $request->input('email'))->first();
            if (!$user) {
                return Helper::jsonErrorResponse('User not found.', 404);
            }

            if ($user->email_verified_at) {
                return Helper::jsonErrorResponse('Email already verified.', 409);
            }

            $newOtp               = random_int(1000, 9999);
            $otpExpiresAt         = Carbon::now()->addMinutes(60);
            $user->otp            = $newOtp;
            $user->otp_expires_at = $otpExpiresAt;
            $user->save();
            Mail::to($user->email)->send(new OtpMail($newOtp,$user,'Verify Your Email Address'));

            return Helper::jsonResponse(true, 'A new OTP has been sent to your email.', 200);
        } catch (Exception $e) {
            return Helper::jsonErrorResponse($e->getMessage(), $e->getCode());
        }
    }

}

LoginController

<?php
namespace App\Http\Controllers\API\Auth;

use App\Helpers\Helper;
use App\Http\Controllers\Controller;
use App\Models\User;
use Exception;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;

class LoginController extends Controller
{
public function Login(Request $request): \Illuminate\Http\JsonResponse
{
$request->validate([
'email' => 'required|string',
'password' => 'required|string',
]);
try {
if (filter_var($request->email, FILTER_VALIDATE_EMAIL) !== false) {
$user = User::withTrashed()->where('email', $request->email)->first();
if (empty($user)) {
return Helper::jsonErrorResponse('User not found', 404);
}
}
// Check the password
if (! Hash::check($request->password, $user->password)) {
return Helper::jsonErrorResponse('Invalid password', 401);
}

        // Check if the email is verified before login is successful
        if (! $user->email_verified_at) {
            return Helper::jsonErrorResponse('Email not verified. Please verify your email before logging in.', 403);
        }

        //* Generate token if email is verified
        $token = $user->createToken('YourAppName')->plainTextToken;

        return response()->json([
            'status'     => true,
            'message'    => 'User logged in successfully.',
            'code'       => 200,
            'token_type' => 'bearer',
            'token'      => $token,
            'data'       => [
                'id'          => $user->id,
                'name'        => $user->name,
                'email'       => $user->email,
                'is_verified' => $user->is_verified,
            ],
        ], 200);
    } catch (Exception $e) {
        return Helper::jsonErrorResponse($e->getMessage(), 500);

    }
}

public function refreshToken(): \Illuminate\Http\JsonResponse
{
    $refreshToken = auth('api')->refresh();

    return response()->json([
        'status'     => true,
        'message'    => 'Access token refreshed successfully.',
        'code'       => 200,
        'token_type' => 'bearer',
        'token'      => $refreshToken,
        'expires_in' => auth('api')->factory()->getTTL() * 60,
        'data'       => auth('api')->user()->load('personalizedSickle'),
    ]);
}

}

ResetPasswordController

<?php

namespace App\Http\Controllers\API\Auth;

use Exception;
use Carbon\Carbon;
use App\Models\User;
use App\Mail\OtpMail;
use App\Helpers\Helper;
use Illuminate\Support\Str;
use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Mail;

class ResetPasswordController extends Controller
{
    public function forgotPassword(Request $request): \Illuminate\Http\JsonResponse
    {
        $request->validate([
            'email' => 'required|email|exists:users,email'
        ]);

        try {
            $email = $request->input('email');
            $otp = random_int(1000, 9999);
            $user = User::where('email', $email)->first();

            if ($user) {
                Mail::to($email)->send(new OtpMail($otp, $user, 'Reset Your Password'));
                $user->update([
                    'otp' => $otp,
                    'otp_expires_at' => Carbon::now()->addMinutes(60),
                ]);
                return Helper::jsonResponse(true, 'OTP Code Sent Successfully Please Check Your Email.', 200);
            } else {
                return Helper::jsonErrorResponse('Invalid Email Address', 404);
            }
        } catch (Exception $e) {
            return Helper::jsonErrorResponse($e->getMessage(), 500);
        }
    }

    public function VerifyOTP(Request $request): \Illuminate\Http\JsonResponse
    {

        $request->validate([
            'email' => 'required|email|exists:users,email',
            'otp' => 'required|digits:4',
        ]);

        try {
            $email = $request->input('email');
            $otp = $request->input('otp');
            $user = User::where('email', $email)->first();

            if (!$user) {
                return Helper::jsonErrorResponse('User not found', 404);
            }

            if (Carbon::parse($user->otp_expires_at)->isPast()) {
                return Helper::jsonErrorResponse('OTP has expired.', 400);
            }

            if ($user->otp !== $otp) {
                return Helper::jsonErrorResponse('Invalid OTP', 400);
            }
            $token = Str::random(60);
            $user->update([
                'otp' => null,
                'otp_expires_at' => null,
                'reset_password_token' => $token,
                'reset_password_token_expire_at' => Carbon::now()->addHour(),
            ]);
            return response()->json([
                'status' => true,
                'message' => 'OTP verified successfully.',
                'code' => 200,
                'token' => $token,
            ]);
        } catch (Exception $e) {
            return Helper::jsonErrorResponse($e->getMessage(), 500);
        }
    }

    public function ResetPassword(Request $request): \Illuminate\Http\JsonResponse
    {
        $request->validate([
            'email' => 'required|email|exists:users,email',
            'token' => 'required|string',
            'password' => 'required|string|min:6|confirmed',

        ]);

        try {
            $email = $request->input('email');
            $newPassword = $request->input('password');

            $user = User::where('email', $email)->first();
            if (!$user) {
                return Helper::jsonErrorResponse('User not found', 404);
            }

            if (!empty($user->reset_password_token) && $user->reset_password_token === $request->token && $user->reset_password_token_expire_at >= Carbon::now()) {
                $user->update([
                    'password' => Hash::make($newPassword),
                    'reset_password_token' => null,
                    'reset_password_token_expire_at' => null,
                ]);

                return Helper::jsonResponse(true, 'Password reset successfully.', 200);
            } else {
                return Helper::jsonErrorResponse('Invalid Token', 419);
            }
        } catch (Exception $e) {
            return Helper::jsonErrorResponse($e->getMessage(), 500);
        }
    }
}

Helper Functions

The Helper class provides:

<?php

namespace App\Helpers;

use Exception;
use Illuminate\Support\Str;
use Kreait\Firebase\Factory;
use Illuminate\Http\JsonResponse;
use Illuminate\Support\Facades\Log;
use Kreait\Firebase\Messaging\CloudMessage;
use Kreait\Firebase\Messaging\Notification;
use Kreait\Firebase\Exception\MessagingException;


class Helper
{
    //! JSON Response
    public static function jsonResponse(bool $status, string $message, int $code, $data = null, bool $paginate = false, $paginateData = null): JsonResponse
    {
        $response = [
            'status'  => $status,
            'message' => $message,
            'code'    => $code,
        ];
        if ($paginate && !empty($paginateData)) {
            $response['data'] = $data;
            $response['pagination'] = [
                'current_page' => $paginateData->currentPage(),
                'last_page' => $paginateData->lastPage(),
                'per_page' => $paginateData->perPage(),
                'total' => $paginateData->total(),
                'first_page_url' => $paginateData->url(1),
                'last_page_url' => $paginateData->url($paginateData->lastPage()),
                'next_page_url' => $paginateData->nextPageUrl(),
                'prev_page_url' => $paginateData->previousPageUrl(),
                'from' => $paginateData->firstItem(),
                'to' => $paginateData->lastItem(),
                'path' => $paginateData->path(),
            ];
        } elseif ($paginate && !empty($data)) {
            $response['data'] = $data->items();
            $response['pagination'] = [
                'current_page' => $data->currentPage(),
                'last_page' => $data->lastPage(),
                'per_page' => $data->perPage(),
                'total' => $data->total(),
                'first_page_url' => $data->url(1),
                'last_page_url' => $data->url($data->lastPage()),
                'next_page_url' => $data->nextPageUrl(),
                'prev_page_url' => $data->previousPageUrl(),
                'from' => $data->firstItem(),
                'to' => $data->lastItem(),
                'path' => $data->path(),
            ];
        } elseif ($data !== null) {
            $response['data'] = $data;
        }

        return response()->json($response, $code);
    }

    public static function jsonErrorResponse(string $message, int $code = 400, array $errors = []): JsonResponse
    {
        $response = [
            'status'  => false,
            'message' => $message,
            'code'    => $code,
            'errors'  => $errors,
        ];
        return response()->json($response, $code);
    }
}

Note if your need custom file upload function than just adding rhis code in Helper.php

 //! File or Image Upload
    public static function fileUpload($file, string $folder, string $name): ?string
    {
        if (!$file->isValid()) {
            return null;
        }

        $imageName = Str::slug($name) . '.' . $file->extension();
        $path      = public_path('uploads/' . $folder);
        if (!file_exists($path)) {
            if (!mkdir($path, 0755, true) && !is_dir($path)) {
                throw new \RuntimeException(sprintf('Directory "%s" was not created', $path));
            }
        }
        $file->move($path, $imageName);
        return 'uploads/' . $folder . '/' . $imageName;
    }

    //! File or Image Delete
    public static function fileDelete(string $path): void
    {
        if (file_exists($path)) {
            unlink($path);
        }
    }

Error Handling

The bootstrap/app.php is configured to:

<?php

use App\Helpers\Helper;
use Illuminate\Foundation\Application;
use Illuminate\Support\Facades\Request;
use Illuminate\Auth\AuthenticationException;
use Illuminate\Validation\ValidationException;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Database\Eloquent\ModelNotFoundException;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        //
    })
     ->withExceptions(function (Exceptions $exceptions) {
        $exceptions->render(function (Throwable $e, Request $request) {
            if ($request->is('api/*')) {
                if ($e instanceof ValidationException) {
                    return Helper::jsonErrorResponse($e->getMessage(), 422, $e->errors());
                }
                if ($e instanceof ModelNotFoundException) {
                    return Helper::jsonErrorResponse($e->getMessage(), 404);
                }

                if ($e instanceof AuthenticationException) {
                    return Helper::jsonErrorResponse($e->getMessage(), 401);
                }
                if ($e instanceof AuthorizationException) {
                    return Helper::jsonErrorResponse($e->getMessage(), 403);
                }
                // Dynamically determine the status code if available
                $statusCode = method_exists($e, 'getStatusCode') ? $e->getStatusCode() : 500;
                return Helper::jsonErrorResponse($e->getMessage(), $statusCode);
            }
            return null;
        });
    })->create();

This implementation provides a solid foundation for a secure Laravel API with comprehensive authentication features.

Building a Real-Time Chat Application in Laravel with Wirechat

AL Mamon — Wed, 07 May 2025 10:07:37 +0000

Why Choose Wirechat?
Wirechat simplifies real-time chat implementation in Laravel applications by providing

Seamless Livewire integration
Built-in WebSocket support
Polymorphic chat relationships
Developer-friendly customization
Production-ready components

Installation Guide

Project Setup

composer create-project laravel/laravel your-project
cd your-project

Authentication Setup (Recommended)

composer require laravel/breeze --dev
php artisan breeze:install
npm install && npm run dev
php artisan migrate

Package Installation

composer require namu/wirechat
php artisan wirechat:install
php artisan migrate

To ensure Tailwind purges CSS classes from the package, add the following lines to your /resources/css/app.css file:

/* resources/css/app.css */

@source '../../vendor/namu/wirechat/resources/views/**/*.blade.php';
@source '../../vendor/namu/wirechat/src/Livewire/**/*.php';

Note: This package requires the @tailwindcss/forms plugin. Make sure it is installed and included in your Tailwind config.

WebSocket Setup

php artisan install:broadcasting

Follow prompts to install Laravel Reverb

php artisan reverb:start

Queue Worker
For optimal performance, prioritize message processing:

bash

php artisan queue:work --queue=messages,default

Development Workflow
Terminal 1: Start Laravel server

php artisan serve

Terminal 2: Start WebSocket server

php artisan reverb:start

Terminal 3: Start queue worker

php artisan queue:work

Terminal 4: Start Vite dev server

npm run dev

Implementation Guide

Make Models Chatable

php
use Namu\WireChat\Traits\Chatable;

class User extends Authenticatable
{
    use Chatable;

    // Your existing model code
}

Starting Conversations Programmatically create chats:

php
// One-to-one chat
$user->startConversationWith($recipient);

// Group chat
$user->createGroupChat([$participant1, $participant2], 'Group Name');

Customizing Components Publish views for customization:

php artisan vendor:publish --tag=wirechat-views

Extending Functionality Create a service provider to extend Wirechat:

php
namespace App\Providers;

use Illuminate\Support\ServiceProvider;
use Namu\WireChat\WireChat;

class ChatServiceProvider extends ServiceProvider
{
    public function boot()
    {
        WireChat::messageReceived(function ($message) {
            // Custom logic when message is received
        });
    }
}

Conclusion

Wirechat provides a robust foundation for Laravel chat applications while maintaining flexibility for customization. By following this guide, you can implement a production-ready chat system quickly while having the option to extend functionality as your application grows.

For further assistance:

Check the package documentation
Review Laravel broadcasting and Livewire documentation
Explore the package source code for implementation examples

Happy coding!