API login from android app using laravel 5.3 passport

Question

For two days I am digging google but could not find the starting thread for my problem, now I am out of option. Please help me with some direction/howTo

I have a web application running built with laravel 5.3, I have installed passport as described here . if I go /home its showing perfectly.

Now I have to make an android app from which

1. An already existing user of web app can login
2. get all the task list of that user TaskModel (ons_tasks(id, title, description))

routes related only

in web.php

Auth::routes();

in api.php

Route::get('/user', function (Request $request) {
    return $request->user();
})->middleware('auth:api');


Route::group(['middleware' => ['auth:api']], function () {

    Route::get('/test', function (Request $request) {
        return response()->json(['name' => 'test']);
    });

    Route::get('/task/list', function (Request $request) {        
        $list = \App\Model\TaskModel::all();
        return response()->json($list);
    });

});

To login : if I send post request /login with email & password get the TokenMismatchException error but Where do I obtain a token for android app in mobile? Do I need the Auth::routes() in the api too? if then what else Do I need to just login and get a token so later I can send it for getting the task lists.

Secondly,

If I go to /api/test it redirects me to /home page without showing any error !!!

Thanks in advance.

Answer 1

To authenticate with your Passport-enabled API

You'll need to use the Password Grant Client in this situation, see this section of Passport's documentation.

Once you've generated a Password Grant Client, using:

 php artisan passport:client --password

You will need to request an access token from your application, and send it with your subsequent requests, in order to access the protected auth:api middleware routes.

To get an access token, send a request to your app's /oauth/token route (this is a PHP implementation obviously, ensure you are correctly formatting below request in your Java implementation):

$http = new GuzzleHttp\Client;

$response = $http->post('http://your-app.com/oauth/token', [
    'form_params' => [
        'grant_type' => 'password',
        'client_id' => '<client id returned from the artisan command above>',
    '    client_secret' => '<secret returned from artisan command above>',
        'username' => '[email protected]',
        'password' => 'my-password',
        'scope' => '',
    ],
]);

return json_decode((string) $response->getBody(), true);

Ensure you add the client_secret and client_id that was returned from the artisan call above, and ensure username and password references a valid user in your database.

If everything is fine here, you should receive an access_token and refresh_token in the response. The access_token is what you need to authenticate using the auth:api guard. To correctly pass this back to your api, you will need to send your subsequent requests with the headers Authorization: Bearer <your accessToken> and Accept: application/json

For example, to access your "test" route:

$response = $client->request('GET', '/api/test', [
    'headers' => [
        'Accept' => 'application/json',
        'Authorization' => 'Bearer '. <accessToken from /oauth/token call>,
    ],
]);

If you've set these correctly, you should see a JSON response with the array you have specified.

Why is /api/test redirecting me with no error?

You are requesting a route with the auth:api middleware. This will redirect you as you have not specified the correct headers as described above, this is expected behavior.

Hope this helps.