How to use Laravel Passport with Password Grant Tokens? : <p>I just read the <a href="https://laravel.com/docs/5.6/passport" rel="noreferrer">https://laravel.com/docs/5.6/passport</a> documentation and I have some doubts that hopefully someone could help me with:</p>

<p>First, some context, I want to use Passport as a way to provide Oauth authentication for my mobile app (first-party app).</p>

<ol>
<li><p>When I use <code>php artisan passport:client --password</code> I get back a Client ID and a Client Secret. Does this value have to be fixed on my app? for example storing them hardcoded or as a "settings" file? If the values shouldn't be stored then how should it work?</p></li>
<li><p>To register a user to my app I use: <code>$user-&gt;createToken('The-App')-&gt;accessToken;</code> I get that the accessToken will be the one used for sending on all my requests as a Header (Authorization => Bearer $accessToken) but what exactly is "The-App" value for?</p></li>
<li><p>For login the user I'm using the URL: <a href="http://example.com/oauth/token" rel="noreferrer">http://example.com/oauth/token</a> and sending as parameters: </p>

<p>{
    "username": "user@email.com",
    "password": "userpassword",
    "grant_type": "password",
    "client_id": 1, // The Client ID that I got from the command (question 1)
    "client_secret": "Shhh" // The Client Secret that I got from the command (question 1)
}</p></li>
<li><p>When I login the user using the previous endpoint I get back a refresh_token, I read that I could refresh the token through <a href="http://example.com/oauth/token/refresh" rel="noreferrer">http://example.com/oauth/token/refresh</a> but I try to request the refresh I got Error 419, I removed the url oauth/token/refresh from the csrf verification and now I get back <code>"message": "Unauthenticated."</code>, I'm making the following request:</p>

<p>Content-Type: x-www-form-urlencoded
grant_type: refresh_token
refresh_token: the-refresh-token // The Refresh Token that I got from the command (question 3) 
client_id: 1  // The Client ID that I got from the command (question 1) 
client_secret: Shhh // The Client Secret that I got from the command (question 1)
scope: ''</p></li>
</ol>

<p>Should I use this endpoint? or is not necessary given the app I'm trying to develop.</p>

<ol start="5">
<li>Finally, there are a lot of endpoints that I get from passport that I don't think I will use for example: <code>oauth/clients*</code>, <code>oauth/personal-access-tokens*</code> is there a way to remove them from the endpoints published by passport?</li>
</ol>

<p>Thanks a lot for your help!</p>
