Laravel中使用Passport获取Access Token遇无效凭证错误的求助

Hey there, let's work through this Laravel Passport issue together—this is a common snag, and I’ve debugged it a few times myself. Here are the most likely fixes to check, ordered by how often they solve the problem:

1. Verify Your User's Password is Hashed Correctly #

Passport’s password grant requires the user’s password to be stored using Laravel’s built-in Hash::make() method. If you manually set a plain-text password in the database, or used a different encryption method, the validation will fail every time.

To fix this, regenerate the password hash using Artisan Tinker:

php artisan tinker
$user = App\Models\User::where('email', 'your-email@example.com')->first();
$user->password = Hash::make('your-actual-password');
$user->save();

Then test your POST request again.

2. Confirm You're Using a Password Grant Client #

Not all Passport clients are enabled for password authentication. Double-check that your client_id and client_secret belong to a password grant client:

1. List all existing clients to verify their type:

php artisan passport:clients --list

Look for a client where the password_client column is 1 (true).

2. If you don’t have a password grant client, create one:

php artisan passport:client --password

Use the new client_id and client_secret from this command in your Postman request.

3. Check User Model Authentication Logic #

If your app uses a non-default field for authentication (like username instead of email), you need to tell Passport to look for it. Add this method to your User model:

public function findForPassport($username)
{
    // Adjust the fields to match your user table (e.g., add 'username' if needed)
    return $this->where('email', $username)->first();
}

Also, ensure your user isn’t marked as inactive or soft-deleted. If you have an is_active field or use soft deletes, make sure the user record is valid and active.

4. Validate Postman Request Format #

It’s easy to mess up the request structure in Postman:

• Go to the Body tab, select raw, and set the format to JSON (not form-data or x-www-form-urlencoded).
• Double-check that all parameters are spelled correctly: grant_type, client_id, client_secret, username, password, and scope should all match exactly.

5. Clear Application Caches #

Stale config or route caches can sometimes break Passport’s authentication flow. Run these commands to reset everything:

php artisan cache:clear
php artisan config:clear
php artisan route:clear

6. Debug the Password Validation Process #

If none of the above works, add logging to your User model to see exactly where the validation fails:

public function validateForPassportPasswordGrant($password)
{
    \Log::info('Validating password for user: ' . $this->email);
    \Log::info('Password hash match status: ' . Hash::check($password, $this->password));
    
    return Hash::check($password, $this->password);
}

Check the storage/logs/laravel.log file after sending your request—this will tell you if the password hash is actually matching the stored value.

内容的提问来源于stack exchange，提问作者Youssef Boudaya