A modular Laravel package for first-party JWT auth, account security, API keys, external identity, and optional OAuth server mode.
Ready-made HTTP endpoints for JWT-native refresh rotation and session revocation, with no OAuth client involved.
Laravel sp-jwt guard, signed access tokens, persisted jti rows, opaque rotating refresh tokens, scopes, claims, and revocation.
MFA challenge broker, hashed OTP codes, email verification tokens, and password reset tokens with app-owned delivery.
Passwordless OTP sign-in and sign-up with hashed code storage, rate limits, and app-owned user creation.
Scoped API keys with public-id lookup, hashed secret validation, rotation, revocation, and middleware.
Socialite/OIDC-style identity normalization and storage while apps own account linking policy.
Optional third-party OAuth clients, authorization-code + PKCE, client credentials, refresh tokens, introspection, and resource middleware.
Lifecycle events and hook points for app audit logging, policy checks, and custom token context rules.