Next, let's learn how to hash your API tokens before it's saved to the database, and then validate against that hash. Okay, so I'm going to switch over to, in this case, the Laracast codebase, and I'm going to go to config/auth.php. Now, right here in the guards section, so we've already talked about this, the API guard. And just to make sure we're on the same page, when we go to our API routes and we apply the middleware, this is our way of saying, I want the auth middleware using the API guard. Not the web guard that you normally do, but the API guard. Now what I want you to see here, if I switch back, is two things. First, the driver name.

Now what I want you to see here, if I switch back, is two things. First, the driver name. It's called token. So we want a token driver. And then next, in Laravel 5.8, you'll see hash is set to false. We're not going to hash or validate against a hashed token in the database. Okay, so how do we find the logic for this? Well, again, a familiarity with the codebase helps. But if we have token here, basically what's going to happen behind the scenes is Laravel will try to create a token driver.

But if we have token here, basically what's going to happen behind the scenes is Laravel will try to create a token driver. And you'll see right here, it instantiates this class called TokenGuard. So if we run that, we get this class. So this is the class that actually validates the request and gets the associated User. Now, don't worry about this too much, but very quickly you'll see, again, it's checking, should we hash it? If so, take the token that was received in the request and then run it through SHA-256 and then use that credential to find the associated User from the database. That's all that's happening there.

and then use that credential to find the associated User from the database. That's all that's happening there. So that means, if I switch back to our config file, if we want the validation to first hash the token, I can update this to true. Now, the only remaining step is to give users the ability to generate a token and to refresh the token. I'll show you some of that in the next episode, but first, let's see a proof of concept. I'm going to boot up php artisan tinker. I'm going to find myself one more time. And I will update this API token.

I'm going to find myself one more time. And I will update this API token. So let's create a token, and again, 60 characters is fine. And now ultimately, this is what you will return to the user. This is their plain text password. Remember, again, it's just a password. We're calling it an API token, but it's essentially your password. But now, we don't want to save that as plain text in the database. We want the hashed version. So I'll say, update the API token to be a hashed version.

We want the hashed version. So I'll say, update the API token to be a hashed version. And again, we're going to do SHA-256. OK, so now, if I look at the token, this is what's being saved to the database, a hashed version. But this is the one you provide to the user. OK, so let's try it out. If I paste in our new token and we run it, we still get the same thing. And again, that's specifically because of right here. We turned on the hash flag.

And again, that's specifically because of right here. We turned on the hash flag. And when we do that, as we saw, Laravel is actually going to hash what is this key right here and then try to find the User. So if I turn that off and then we run this again, we'll get unauthenticated. Because in that case, Laravel is trying to find the User where the API token is this. But there is none in the database. Only the hashed version is. OK, so if I bring that back to true, this will work yet again. So the next step would be to actually build a layer or settings page to allow users to

OK, so if I bring that back to true, this will work yet again. So the next step would be to actually build a layer or settings page to allow users to generate a token or to delete and refresh the token they want to use. We'll talk about that in the next episode.