Building API Key Generator

I want to build an API Key generator. Here are some of the code snippets:

API keys table

 /**
     * Run the migrations.
     */
    public function up(): void
    {
        Schema::create('api_keys', function (Blueprint $table) {
            $table->id();
            $table->string('token');
            $table->datetime('expires_at');
            $table->timestamps();
        });
    }

API Key Generation logic. Bear in mind that this would be full CRUD with option to revoke etc. NOTE : This is just an example. This key can only be generated by logged in users:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Str;
use App\Models\ApiKey;

class ApiKeyController extends Controller
{
    public function generateApiKey()
    {
        $apiKey=(string) Str::orderedUuid();

        $query=ApiKey::create([
            "token"=>$apiKey,
            "expires_at"=>now()->addMinutes(30)
        ]);

       dd($apiKey);
    }
}

API Key authentication Middleware:

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
use App\Models\ApiKey;
use Carbon\Carbon;

class AuthenticateApiKey
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next): Response
    {
        $token = $request->bearerToken(); // Get the Bearer Token from the request

        if (!$token) {
            return response()->json(['message' => 'Unauthorized'], 401);
        }

        $apiKey = ApiKey::where('token', $token)->first();

        if (!$apiKey) {
            return response()->json(['message' => 'Invalid API key'], 401);
        }

        // Check if the API key has expired
        if ($apiKey->expires_at && Carbon::now()->gt($apiKey->expires_at)) {
            return response()->json(['message' => 'API key has expired'], 401);
        }

        return $next($request);
    }
}

Middleware Alias:

'api.key' => \App\Http\Middleware\AuthenticateApiKey::class,

Usage:

Route::middleware('api.key')->group(function () {
    Route::get('/test-api', function () {
        return response()->json(['message' => 'Access Granted!']);
    });
});

Am I missing anything or is there an OAuth2 flow that I can use to produce similar results?

NB: This is for use in authenticating public APIs or APIs that DO NOT require user authentication such as those for SPA blog apps or you want to give third-party apps an option to access some resources of your application.