// the find
hasinhayder/hydra
Hydra is a zero-config API boilerplate with Laravel 10x + Laravel Sanctum that comes with an excellent user and role management API out of the box
Hydra is a Laravel 10 + Sanctum starter that ships working CRUD for users, roles, and role assignment out of the box, gated by Sanctum ability middleware and seeded with a default admin and five roles. It's for someone bootstrapping a small-to-mid API project who wants auth/RBAC endpoints done so they can start on actual business logic.
Every endpoint is already wired to Sanctum's ability/abilities middleware with a consistent error:0/1 response shape, so the auth plumbing is genuinely done, not stubbed. Seeders give you a running admin user and five roles immediately after migrate --seed, matching the 'zero-config' claim for a first run. It has an actual Feature test suite (login, roles, user-role assignment) instead of just the default Laravel example test, plus CI running against both PHP 8.1 and 8.2.
The 'role management' is just a flat user_roles pivot with role slugs hardcoded into route middleware (ability:admin,super-admin) — there's no permission granularity, so any real RBAC need means tearing this out. List endpoints for users and roles return full unpaginated arrays, which is fine for a demo and breaks the moment the table has any real size. The default admin password ('hydra') is checked into a seeder and printed in the README, and login doesn't revoke prior tokens by default (DELETE_PREVIOUS_ACCESS_TOKENS_ON_LOGIN is off), so tokens accumulate per user unless you flip that env var. Last pushed June 2024 and still pinned to Laravel 10/Sanctum 3 with no Laravel 11/12 branch, so it's already a couple of major versions behind current Laravel.