I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation here:

When using hashed API tokens, you should not generate your API tokens during user registration.

The questions are:

  1. When should the token being generated if it's not during registration?
  2. Is the token supposed to be generated on every login with specified expiration time?

Thank you!

  • In the documentation that you mentioned, the recommendation is to use Laravel Passport, "which provides a full OAuth2 server implementation for your Laravel application". Have you checked this already? Feb 3, 2020 at 16:37
  • The Laravel Passport documentation explains when and how an API token is generated, and that it's default lifetime is 1 year. Feb 3, 2020 at 16:39
  • As you said, Laravel Passport uses OAuth 2.0 which is the best for inter-application Authentication (and Authorization, I think...) but in this case, the API server only serve one mobile app (which supports Android and iOS). That's the reason why I prefer more simple approach but keep it secure. Feb 3, 2020 at 16:51

1 Answer 1


laravel use php concepts and libraries.

so if we install any jwt libraries we can find out all of them use a configuration file for set expire date for jwt tokens ( for example 7 days. ) see this article

you as developer can configure it e.g 30 s. https://stackoverflow.com/a/41268134/308578

if you watch this video i definitely sure ,you can found out more about jwt token libraries functionality and their concepts . but this video about nodejs but concept is the same ....

any time to want you can refresh or generate tokens and pass it to your clients.

i think after this video you can understand more all you want


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .