API tokens

Electrik uses Laravel Sanctum personal access tokens. Users create and revoke tokens from Settings → API tokens.

A token is either:

• Personal — scoped to the user only, no team_id.
• Team — carries a team_id. Requests run through electrik.token-team, which switches current team + Spatie context before your route runs.

Creating a team token requires tokens.manage (or ownership). Tokens support expiry presets (never|7|30|90|365) and show last_used_at when present.

Abilities come from config('electrik.api_tokens.abilities'). Guard routes with:

Route::get('/reports', ReportsController::class)
    ->middleware('electrik.ability:read,*');

A token with * always passes. Session/web auth (no token) also passes, so the same route works for browser and API clients.

Registered under api + prefix api:

Returns id, email, name, token meta (abilities, last_used_at, expires_at), and current team.

curl -H "Authorization: Bearer <token>" https://your-app.test/api/electrik/me

Reports metered Stripe usage for the current team:

curl -X POST https://your-app.test/api/electrik/usage \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"stripe_price_id":"price_xxx","quantity":5}'

Electrik ensures throttle:api on the api group and registers a default 60/min limiter named api if the host app never defined one.

composer require dedoc/scramble

Suggested in Electrik’s composer.json; not required.