Back

I've implemented this exact stack (PASETO + argon2id + Laravel 10) in production. Here's my practical advice: 1. First, make sure your PHP installation has libsodium extensions enabled 2. Use paragonie/paseto package (composer require paragonie/paseto) 3. Create a dedicated PasetoService class to handle token creation/validation 4. Implement a custom user provider and guard For argon2id, ensure you're using the correct parameters for your environment (memory cost, time cost, etc.) The biggest challenge was making this work with Laravel's stateless API authentication. I ended up extending Sanctum and replacing its token generation with PASETO tokens. This approach lets you benefit from Sanctum's middleware while using more secure tokens underneath.

Coming from Go to Laravel for PASETO is like going from a sports car to a horse and carriage. In Go, the paseto library is clean, well-maintained, and has excellent native argon2id support. The PHP ecosystem is fragmented by comparison. If you absolutely must use Laravel, consider creating a microservice in Go that handles just the authentication/token generation, and have your Laravel app communicate with it. This gives you the best of both worlds: Go's superior cryptographic libraries and Laravel's... whatever Laravel is good for.