Google Authenticator

Hi there,

What is the API in question that you are trying to consume? In most cases there should be there should be an option for a long lived refresh token, you could check if the server supports the OAuth 2.0 protocol or a similar authentication mechanism that allows the use of refresh tokens. Refresh tokens can be used to obtain new access tokens without requiring the user to log in again. This would allow you to maintain a session without the need to enter the TOTP every time.

If this is indeed the only way of doing it, here is how you might be able to achieve it:

1. Install Guzzle HTTP

Make sure the Guzzle HTTP library is installed, as Laravel's HTTP client uses it under the hood:

composer require guzzlehttp/guzzle

2. Create an AuthenticationService

Consider creating a dedicated service class to handle authentication and token management. This will keep your code organized and easier to maintain.

<?php

namespace App\Services;

use Illuminate\Support\Facades\Http;

class AuthenticationService
{
    private $token;

    public function authenticate($username, $password, $totp)
    {
        $response = Http::post('https://server/restapi/v2.0/auth', [
            'grantType' => 'password',
            'userAuthDevice' => new \stdClass(),
            'username' => $username,
            'password' => $password,
            'totp' => $totp,
        ]);

        if ($response->successful()) {
            $this->token = $response->json()['token'];
            return $this->token;
        }

        throw new \Exception('Authentication failed');
    }

    public function getToken()
    {
        return $this->token;
    }

    // Additional methods for refreshing the token if needed
}

3. Schedule the Token Renewal

If you need to refresh the token every 20 minutes, consider using Laravel's task scheduling to run a command that refreshes the token.

First, create a console command to refresh the token:

php artisan make:command RefreshToken

In your command class, inject the AuthenticationService and call the method to refresh the token:

public function handle(AuthenticationService $authService)
{
    // Logic to refresh the token
    $authService->refreshToken();
}

Then, in your App\Console\Kernel.php, schedule the command to run every 20 minutes:

protected function schedule(Schedule $schedule)
{
    $schedule->command('refresh:token')->everyTwentyMinutes();
}

4. Use the Token in Other Requests

Whenever you need to make authenticated requests to the API, use the token from the AuthenticationService.

$response = Http::withHeaders([
    'Authorization' => 'Bearer ' . $authService->getToken(),
])->get('https://server/restapi/v2.0/endpoint');

One potential problem that I can think of here is that there might be a rate limit and requesting a new token every 20 mins might be too much, so it would be worth checking if this is the case in the API docs.

What I could also mention is that you would need to ensure that you handle tokens securely, potentially by storing them in a secure way in your environment, especially if they are long-lived refresh tokens. Also, make sure to handle failures and edge cases (e.g., token expiration, server errors) gracefully within your application.

You can take a look at this post here on how to use encryption:

How to encrypt and decrypt a string in Laravel?

Hope that this helps!

Best,

Bobby

Hi Brian 👋

Please check my article attached below to solve your problem: https://devdojo.com/superdev/how-to-add-two-factor-authentication-to-your-laravel-application

Ah nice! Thanks for sharing that @superdev!

Hi Guys,

Thanks for the feedback.

Just a small clarification. The data I am trying to consume is coming from another system that I do not have any control over.

I want to read data from that system using a API which will only function once I am authenticated using 2FA.

It does indeed have a refresh token available. How would I use this? Sorry for the basic question.