Laravel Fortify SPA Authentication with Laravel Sanctum without Jetstream

In this series, we will add Laravel Fortify features to the SPA that uses Laravel Sanctum for authentication without using Laravel Jetstream. Laravel Fortify is a headless authentication system for Laravel. It does not care what front-end you choose, instead, it gives you the flexibility to use whatever front-end you want. You are able to specify which views to render for specific actions, but what about SPA or API? SPAs don't have blade views, it has client-side routing. It may seem a difficult task at first but Laravel Fortify makes this very easy & that is what we cover in this series. We'll be authenticating SPA using Laravel Fortify without Laravel Jetstream. We will also use LaraveL Sanctum to authenticate the SPA.

🤝 You can support me by giving my videos a 👍 & by subscribing to the channel ✔️

--- Note ---
At the time of recording these videos, there was no formal documentation on Laravel Fortify. Now there are docs on the Laravel docs page. Also, there was no way to disable the views by using the configuration, it was added later.

---- Source Code ----

--- Laravel Fortify Without Jetstream Series ---

[riccardogiuseppedeleo]

Well done Gio, I was trying to replace inertia with my spa and it was impossible and then I found your series, really useful, thanks!

[oanacristea]

Thank Finalyy ... someone explains Fortify the right way: with an use case which was intended for, api ... not with the blades. 🙌

[denissmuntjans]

I like your tutorials, well done! My only suggestion would be - please don't rush when you speak because sometimes it's hard to follow!

[ferdinandeke]

ok, I go it to work, had to do a new install of laravel.. And it worked this time on the very first try. same steps I took honestly. very strange. thanks once more bro

[DMZee]

Nice tutorial Gio. I'm new to Laravel. Don't know if this is the right way to start

[kartiksuthar]

Thanks for the video. A newbie question, do you think its a good idea to use JetStream if I also need to build a mobile app along with the web app? I know jetstream is only scaffolding for the web app, so i ll have to maintain business logic via api routes for mobile too.

[oscarburgos]

Thanks for sharing !!! Keep on doing it ...

[tanzimibthesam]

So basically Jetstream is a UI scaffolding with Inertia or Livewire under the hood main thing is Fortify

[ahmadkharabsheh-oj]

why not use fortify default routes and customize actions if needed ?
is there any benefits ?
thanks

[perfect.stealth]

I don't know what fortify did for this app. It works same as the previously mentioned video?

[tysonmccarney]

What sorcery is this??!? I cannot get sanctum SPA to work with fortify without the "StartSesssion" middleware as well. The docs and all examples I have seen just show the requirement. I can authenticate fine but without StartSession all requests to routes behind auth:sanctum return 401 unauthorized. Add StartSession and it works perfectly fine.

I ended up making my own stateful-api middleware group that uses the api routes. In the fortify config, I set the middleware to 'stateful-api' and added my new prefix, then was able to use their routes fine without having to use Fortify::ignoreRoutes(). Kept the api routes file cleaner.

[negrepm.castro]

Good day sorry I'm new with Laravel i want to know if this serie is ok for me

[mohamadcheaib]

What about 2fa otp for the mobile app!!?
is their a way to implement fortify to work for stateless rest api, because fortify works based on statefull app upon sessions

[HarikrishnanM]

when I am checking the fortify routes in postman, I am getting html response..How can I test my apis in postman ?

[alexlytle]

How does your application deal with sanctum session tokens?

[AlekseyPanivanov]

I successfully managed to configure everything, but at the very end, when I request the address "/login", I get the message " {"two_factor": false} " and nothing else. After that, I try to make an API request at the address "/ api/user " and get a message that I am not logged in. What Could be the problem?

[NIKHILSCI-tg]

how to make laravel api for Authentication with Laravel Sanctum using mongodb ?

[AbrarAhmad-mzvl]

Hi,
I try this approach but getting this error.

"message": "CSRF token mismatch.",
"exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException",
"file": "/Users/abrar/Documents/www/api-new/vendor/laravel/framework/src/Illuminate/Foundation/Exceptions/Handler.php",
"line": 368,

[manojyadav]

Why we are ignoring Fortify routes ( Fortify:ignoreRoutes() )? I think it is working without ignoring it also.

[versobyte]

will NOT authenticate sessions on the API middleware group. I keep on getting unauthenticated.

I also tried running your code as well, but I get unauthenticated as well!

Please read the Github issue report for more information. I go in more depth about the problem.

I have been trying to solve this problem for almost half a week now.