Step 06 · Connect a client

Goal: reach the exact decision from step 05 — but now from application code, not tinker. You’ll use
laravel-iam-client to check a permission with the Iam facade, then protect an HTTP route so Alice gets
in (200) and Bob is refused (403).

Server vs client — and why local mode here

A consuming app never re-implements the rules — it delegates every authorization decision to the PDP through
laravel-iam-client. The client has two transports:

• local — the server lives in the same app, so the client resolves the server’s AuthorizationEngine
  from the container and calls the PDP in-process (no network). This is our tutorial’s single-app setup.
• http — the server is remote; the client POSTs each query to
  {base}/api/iam/v1/decisions/check with a Bearer token. This is the production topology.

We use local because server and client are in one app. Switching to http later is one env var. See
Choose a transport.

1. Configure the client

You installed laravel-iam-client in step 01. Publish its config and point it at local mode:

php artisan vendor:publish --tag=laravel-iam-client-config

In .env:

IAM_CLIENT_MODE=local
IAM_CLIENT_APP=warehouse

IAM_CLIENT_APP=warehouse becomes the default application on every query, so you don’t repeat it at each
call site. Clear the config cache:

php artisan config:clear

2. Check a decision from code — the Iam facade

The quickest way to ask IAM from application code is the facade. Smoke-test it in tinker:

php artisan tinker

>>> use App\Models\User;
>>> use Padosoft\Iam\Client\Facades\Iam;

>>> $alice = User::find(1);
>>> $bob   = User::find(2);

>>> Iam::can($alice, 'warehouse:stock.adjust');   // Alice holds the role granted in step 05
=> true
>>> Iam::can($bob, 'warehouse:stock.adjust');     // Bob has nothing
=> false

// Need the full decision (explanation, step-up)?
>>> Iam::check($alice, 'warehouse:stock.adjust', ['explain' => true])->granted();
=> true

3. Protect a route — real 200 / 403

Now enforce it at the edge. Two things to know for this single-app setup:

A stand-in login (tutorial only)

iam.can needs an authenticated user ($request->user()). In step 07 that comes from real OIDC login; for
now, add a tiny insecure, tutorial-only login route so you can switch identity by id. In
routes/web.php:

use App\Models\User;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Route;
use Padosoft\Iam\Client\Http\Middleware\IamCan;

// ⚠️ TUTORIAL ONLY — never ship a login-by-id route. Replace with real login (step 07).
Route::get('/dev-login/{id}', function (int $id) {
    Auth::loginUsingId($id);
    return redirect('/warehouse/adjust');
});

// The protected route: only subjects the PDP permits for warehouse:stock.adjust may enter.
Route::get('/warehouse/adjust', fn () => 'You may adjust stock. ✅')
    ->middleware(IamCan::class.':warehouse:stock.adjust');

Try it

Serve the app and visit the routes in a browser (the session cookie carries the login):

php artisan serve

4. Keep your existing Laravel code working

The client also registers a Gate adapter, so your existing @can and $this->authorize() calls consult
IAM automatically for namespaced abilities (those containing :):

@can('warehouse:stock.adjust')
    <button>Adjust stock</button>
@endcan

No rewrite — the same central decision, through Laravel’s own Gate. See
Gate adapter.

What you just did

Next: replace the stand-in login with a real OIDC / OAuth login against the server’s IdP.

→ Step 07 · OIDC / OAuth login

Deeper references: laravel-iam-client docs ·
Protect routes ·
Ask the PDP