Now, when you're working with third-party APIs that require some form of authorization, which is what we're effectively doing here, just as a demo, this key needs to be something that you can generate or revoke. So that is something to consider, especially if you yourself own the third-party API that we are authorizing against. Let me give you an example of what that might look like. OK, so if this is a token that we presumably got from our Laracast settings area, all right, well, I'm going to switch over to Sublime, and here you'll see I'm not within the assets website, I'm in the Laracast codebase. And you can see I've set up a controller here that we can access by visiting /settings.

website, I'm in the Laracast codebase. And you can see I've set up a controller here that we can access by visiting /settings/access. Now when we hit that route, it'll load this view that will render this simple HTML. We have a heading and then a form that will submit a PATCH request to /settings/access. OK, so if we switch back to the browser and I visit this page, again, very, very simple stuff. In real life, you might want to make it fancy with a modal that pops up and the update is made through an AJAX request, but we're going to keep it super simple and use a standard HTML form.

made through an AJAX request, but we're going to keep it super simple and use a standard HTML form. OK, so let's think. When I submit this form, it'll submit a PATCH request to this endpoint. Now I've already registered that in my routes file. So if I create an update method, you can see we are hitting this method here. So let's give that a shot. And sure enough, we are. OK, so let's think. At this point, we would need to fetch the authenticated User.

OK, so let's think. At this point, we would need to fetch the authenticated User. You can either do it like that, or don't forget, you can find the user through the request as well. OK, we could do update or forceFill if there's any kind of guarding that you need to get around. So let's do that. And I'm going to set the apiToken equal to a new token. So we'll do Str::random here. Finally, we will persist.

So we'll do string random here. Finally, we will persist. Now a quick note, an episode or two ago, I did show you how to enable hashing for the token, which I think was introduced for Laravel 5.8. In this case, we're not using it, we're not going to hash it, but it is something I would recommend for your own projects. So just remember that you would hash it like so. OK, so now, for my Laracasts codebase, I have a little flash overlay here. We have generated a new token for you. And then finally, we can redirect back.

We have generated a new token for you. And then finally, we can redirect back. OK, so if we give this a run, I will generate a new token, there we go, which means because we have a very simple implementation and you only get one token per User, well, this token is now by definition revoked. So if we try it again, it'll say unauthenticated. Now of course, you can make this as fancy as you want. Your app could allow the User to generate any number of tokens. It's just a matter of what the needs are. In this case, a single token per User is fine.

It's just a matter of what the needs are. In this case, a single token per User is fine. But now notice one issue is we generated a token and we didn't tell you what it was. OK, let's fix that. So it sounds like we want to save the token and then, well, we could put it here if you want, like so. So give it another run, and now we have received the token. And usually, for things like this, you want to give the User a note that they should write this down, especially if it's going to be hashed in the database. You're not going to store that original key, so you need to let them know, here is your