Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

HynekS's avatar

Laravel passport – how can I check the validity of refresh token (while not revoking it)?

Using Laravel Passport, how can I check if a refresh token is still valid?

I'm not asking about the access token: that one I can verify by requesting any rout implementing the Route::middleware(auth:api)->get('any-protected-route', function () { return true });

I know how to use it to request a new access and refresh tokens (querying oauth/tokens), but it will revoke the current one 🤷‍♂️.

Use case: I have a refresh token stored as an HttpOnly ✓ cookie, and I'd like to use it to validate requests for static resources (native <img src="…"> or background-image: url(…), because it is being sent by browser with every request. But I don't know how to validate it (non-destructively) in the Controller.

(I am aware of the access tokens as a query string solution, but I'd rather avoid it due to possible security issues).

Thank you.

0 likes
0 replies

Please or to participate in this conversation.