Introduction

APIs power modern web and mobile applications, but they also open up new attack surfaces. Laravel Sanctum provides a lightweight, first-party solution for authenticating Single Page Applications (SPAs), mobile apps, and simple token-based APIs. In this post, you’ll learn how to:

Install and configure Sanctum
Protect your API routes
Issue and revoke tokens
Secure both SPAs and mobile clients
Write tests to verify your setup

Let’s dive in!

1. Install & Publish Sanctum

Require the package via Composer:
```
composer require laravel/sanctum 
```

Publish the configuration and migration:

php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

Run the migrations to create the personal_access_tokens table:
```
php artisan migrate 
```

2. Configuration

In config/sanctum.php, you’ll find:

stateful domains (for SPA authentication)
expiration of issued tokens
middleware applied to your API routes

By default Sanctum uses your application’s api guard. You can customize guards in config/auth.php if needed.

3. Protecting Routes

In routes/api.php, wrap any routes you want protected with the auth:sanctum middleware:

use Illuminate\Http\Request; use Illuminate\Support\Facades\Route;  Route::middleware('auth:sanctum')->group(function () {     Route::get('/user', function (Request $request) {         return $request->user();     });      Route::post('/posts', [PostController::class, 'store']);     // …more protected endpoints… });

Anyone calling these endpoints must include a valid token in their Authorization header.

4. Issuing & Revoking Tokens

4.1 Personal Access Tokens

From any authenticated user, you can create a token like this:

$user = Auth::user();  // Create a token with optional abilities (scopes) $token = $user->createToken('mobile-token', ['create', 'update'])->plainTextToken;  return response()->json([     'access_token' => $token,     'token_type'   => 'Bearer', ]);

To revoke all of a user’s tokens:

$user->tokens()->delete();

Or revoke a single token by ID:

$user->tokens()->find($tokenId)->delete();

5. Authenticating SPAs

Sanctum uses Laravel’s session cookies to authenticate SPAs. In config/sanctum.php, add your frontend domain to the stateful array:

'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost:3000,myapp.test')),

Then, from your SPA (e.g. React/Vue), first hit the /sanctum/csrf-cookie endpoint, and subsequent calls to /login or any auth:sanctum routes will use the session cookie automatically.

6. Authenticating Mobile & Third-Party Clients

Mobile apps and third-party services can’t use cookies; instead, they’ll use the tokens you issued. Include in your requests:

Authorization: Bearer YOUR_PERSONAL_ACCESS_TOKEN

Sanctum will validate the token and check any abilities you defined.

7. Testing Your Setup

Feature Test Example

public function test_can_access_protected_route() {     $user = User::factory()->create();     $token = $user->createToken('test-token')->plainTextToken;      $response = $this->withHeaders([         'Authorization' => 'Bearer ' . $token,     ])->getJson('/api/user');      $response->assertStatus(200)              ->assertJson(['id' => $user->id]); }

Token Revocation
Verify that after deleting a token, requests fail with a 401 Unauthorized.

Conclusion

Laravel Sanctum makes it easy to secure your APIs with both session-based SPA authentication and token-based access for mobile or third-party clients. By following the steps above—installing Sanctum, protecting routes, issuing tokens, and writing tests—you’ll have a robust authentication layer in minutes.

Happy coding! 🚀

Hello I'm Akorede Ogunsola

Recent Posts

Building Secure APIs with Laravel Sanctum

Introduction

Hello I'm
Akorede Ogunsola