forceFill([ 'api_token' => hash('sha256', $token), ])->save(); return response()->json([ 'token' => $token ]); } public function destroy() { user()->forceFill([ 'api_token' => null, ])->save(); return response('', 204); } }