Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Kejax's avatar
Level 1

Check if an oauth client was used (Passport)

Is there a way to check if an 3rd party oauth app was used to interact with the endpoint? If so, how would I be getting the client information?

I've been searching this forum and google for an answer, nothing that answers my question so far.

Thanks for any help in advance!

0 likes
7 replies
Talinon's avatar

@kejax You could inspect the user agent information within in the request:

request()->server('HTTP_USER_AGENT')

But there is no guarantee if someone is being malicious.. this information can easily be altered by the requesting client.

2 likes
martinbean's avatar

@kejax OAuth tokens are issued via OAuth clients. So you know which client was used by checking which client the token used the authorise the request belongs to.

2 likes
martinbean's avatar

@Kejax Well why do you need to know the client? A token identifies a user.

2 likes
Kejax's avatar
Level 1

@martinbean I want to mark if a post has been done via an 3rd party app and show it's name on the site, e.g. "This post was uploaded via {APP_NAME}"

martinbean's avatar
Level 80

@Kejax Gotcha.

If you’re authenticating using an OAuth bearer token, then the authenticated user instance will have a token method that you can use to get the Token model, and its client relation:

Route::middleware('auth:api')->group(function () {
    // Routes protected with auth:api middleware
});
public function someControllerAction(Request $request)
{
    // Get authenticated user
    $user = $request->user();

    // Get Token model user used to authorise request
    $token = $user->token();

    // Get the client associated with the token
    $client = $token->client;
}

So from the Client model instance, you can access its attributes, including name, or just use the client_id from the token itself to save in your post model:

class PostController extends Controller
{
    public function store(StorePostRequest $request)
    {
        $user = $request->user();

        $post = $user->posts()->make($request->validated());

        $post->client()->associate($user->token()->client)->save();

        // Return response...
    }
}

This is assuming your Post model has a client relation that points to a Laravel\Passport\Client model instance:

@foreach($posts as $post)
    <h1>{{ $post->headline }}</h1>
    @if($post->client)
        <p>This post was uploaded via {{ $post->client->name }}</p>
    @endif
@endforeach
1 like
Kejax's avatar
Level 1

@martinbean Thank you! I'll try it later, but this is exactly what I've been looking for. I really appreciate your help

1 like

Please or to participate in this conversation.