DEV Community

ArtisanJack (っ◔◡◔)っ
ArtisanJack (っ◔◡◔)っ

Posted on

I stopped asking for Laravel Cloud API tokens

#php #laravel #architecture

I originally verified LaraShipped launches with a Laravel Cloud API token.

Creators pasted a token. I stored it encrypted, never showed it again, and used it to inspect environments. On paper that proved the app lived in their Cloud account.

In practice, people didn't want to give me a token. I wouldn't either.

So I changed the contract.

What we check now

You paste an HTTPS *.laravel.cloud URL. That's it.

Then we:

  • resolve DNS and refuse anything that isn't a public address
  • probe the origin without cookies or credentials
  • refuse off-origin redirects (a / → /login on the same host counts as reachable; we don't follow it)
  • compare the Cloud slug against the project's live hostname, including custom domains

artisanbizops.com can match artisan-bizops-x1233.laravel.cloud after we strip separators from the first label. That's a consistency check, not proof that you own the Cloud org.

If the names don't match, we fail before the outbound probe. No point hitting the network for a URL that can't belong to this project.

A successful probe never publishes the project. You still have to hit publish.

A failed or stale daily recheck makes it private. We don't auto-republish later. Showcase lists go stale when a card stays pretty after the app dies. I'd rather the page disappear.

The probe is read-only. It doesn't trigger deploys, restart environments, or buffer an unbounded response. If HEAD comes back 405 or 501, we may fall back to a streamed GET, but the body is capped at 64KB and then closed.

What this is not

Someone could still point a *.laravel.cloud URL at an app that isn't theirs if they guessed a slug and the live hostname lined up. Token-backed verification was stronger on ownership. URL-backed verification is stronger on is this actually up, and on not holding a secret I don't need.

That tradeoff is the product. LaraShipped is a verified Laravel Cloud registry, not a general launch directory.

If you've shipped something on Cloud and you're tired of directories that never check, the door is open: larashipped.laravel.cloud

Top comments (0)