Token management in Laravel - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Laravel Sanctum token creation code?

Consider the following Laravel code snippet that creates a token for a user. What will be the output of return $token;?

Laravel

<?php
$user = App\Models\User::find(1);
$token = $user->createToken('api-token')->plainTextToken;
return $token;

A A string representing the plain text token, e.g., '1|randomcharacters...'

B An object containing token details including expiration

C A boolean true indicating token creation success

D Null, because the token is not returned by default

💡 Hint

Remember that createToken returns a NewAccessToken object, and plainTextToken is a string.

The createToken method returns a Laravel\Sanctum\NewAccessToken object. Accessing plainTextToken property returns the token string that can be used for authentication.

❓ state_output

intermediate

What is the value of $user->tokens()->count() after revoking tokens?

Given a user with 3 active tokens, what will be the count after running this code?

$user->tokens()->delete();

Laravel

<?php
$user = App\Models\User::find(1);
// Assume user has 3 tokens
$user->tokens()->delete();
$count = $user->tokens()->count();
return $count;

A null

B 3

C 0

D Throws an exception

💡 Hint

Deleting tokens removes them from the database.

Calling tokens()->delete() deletes all token records for the user. Therefore, counting tokens after deletion returns 0.

📝 Syntax

advanced

Which option correctly revokes a specific token by its ID?

You want to revoke a token with ID 5 for a user. Which code snippet does this correctly?

A $user->tokens()->remove(5);

B $user->tokens()->find(5)->revoke();

C $user->tokens()->destroy(5);

D $user->tokens()->where('id', 5)->delete();

💡 Hint

Tokens are Eloquent models; deleting by query is common.

The tokens() relationship returns a query builder. Using where('id', 5)->delete() deletes the token with ID 5. The other methods either don't exist or cause errors.

🔧 Debug

advanced

Why does this token authentication fail in Laravel Sanctum?

Given this middleware code, why does token authentication fail?

public function handle($request, Closure $next) {
  if (! $request->user()) {
    return response()->json(['error' => 'Unauthenticated'], 401);
  }
  return $next($request);
}

A The user model does not implement HasApiTokens trait

B The token is not sent in the Authorization header as Bearer token

C The middleware does not call <code>auth()->check()</code>

D The middleware should return <code>$next($request->user())</code> instead

💡 Hint

Check how Sanctum expects tokens to be sent in requests.

Laravel Sanctum expects the token to be sent in the Authorization header as a Bearer token. If the token is missing or malformed, $request->user() returns null, causing authentication failure.

🧠 Conceptual

expert

Which statement about Laravel Sanctum token abilities is true?

Consider token abilities (scopes) in Laravel Sanctum. Which option correctly describes their behavior?

A Abilities restrict what actions a token can perform; checking abilities is done via <code>$request->user()->tokenCan('ability')</code>

B Abilities automatically expire tokens after 24 hours

C Abilities are stored encrypted and cannot be read by the application

D Abilities are only used for SPA authentication, not API tokens

💡 Hint

Think about how you limit token permissions in Laravel Sanctum.

Abilities (or scopes) define what a token is allowed to do. You check them in your code with tokenCan(). They do not control expiration or encryption, and they apply to API tokens as well as SPA tokens.