authentikate/app/Console/Commands/GenerateKeys.php

<?php

namespace App\Console\Commands;

use Illuminate\Console\Command;

class GenerateKeys extends Command
{
    /**
     * The name and signature of the console command.
     *
     * @var string
     */
    protected $signature = 'app:generate-keys';

    /**
     * The console command description.
     *
     * @var string
     */
    protected $description = 'Generate RSA key pair for OIDC (RS256)';

    /**
     * Execute the console command.
     */
    public function handle()
    {
        $keyDir = storage_path('oauth');

        if (!is_dir($keyDir)) {
            mkdir($keyDir, 0700, true);
        }

        $privatePath = "$keyDir/private.pem";
        $publicPath  = "$keyDir/public.pem";

        if (file_exists($privatePath) || file_exists($publicPath)) {
            $this->warn('Keys already exist. Aborting.');
            return 1;
        }

        $this->info("Generating RSA key pair...");

        // Generate 2048-bit RSA private key
        $res = openssl_pkey_new([
            'private_key_bits' => 2048,
            'private_key_type' => OPENSSL_KEYTYPE_RSA,
        ]);

        openssl_pkey_export($res, $privateKey);
        file_put_contents($privatePath, $privateKey);
        chmod($privatePath, 0600);

        $pubKeyDetails = openssl_pkey_get_details($res);
        file_put_contents($publicPath, $pubKeyDetails['key']);
        chmod($publicPath, 0644);

        $this->info("✅ Keys generated:");
        $this->line("- Private: $privatePath");
        $this->line("- Public : $publicPath");

        return 0;
    }
}