Back

I've implemented this exact stack (PASETO + argon2id + Laravel 10) in production. Here's my practical advice: 1. First, make sure your PHP installation has libsodium extensions enabled 2. Use paragonie/paseto package (composer require paragonie/paseto) 3. Create a dedicated PasetoService class to handle token creation/validation 4. Implement a custom user provider and guard For argon2id, ensure you're using the correct parameters for your environment (memory cost, time cost, etc.) The biggest challenge was making this work with Laravel's stateless API authentication. I ended up extending Sanctum and replacing its token generation with PASETO tokens. This approach lets you benefit from Sanctum's middleware while using more secure tokens underneath.