Laravel API Auth with Sanctum and API Tokens

This is a free lesson from my upcoming course "How to Create Laravel API". We take a look at one of the ways to authenticate the API user - by issuing a long-term token which will be used in all the requests.

Subscribe for -50% discount for the upcoming course:

- - - - -

[jhonbarcasnegras]

Two days trying to understand it and suddenly this video saves my life in a few minutes.
Thank you.

[HansVandetas]

Thankyou for your brief & clear explanation, straight to the point & solving my problem

[redamakarem]

Love your content
Just bought the course
All the best man <3

[evangelistenockmwakapalila]

This was killing me with pain but just a minute you made my day happy DUDE

[Mocka-yfez]

thank you so much your explanation so clear

[vladimircontreras]

If I use a "role abilities" approach (for the User model), the token ability can be bypassed or should that be considered a totally different type of authorization?

[Shortgrauzis]

Thank you. I was stuck on using a token from database which is encrypted? I guess. Did not realize I needed to use plaintext one.

[vlauciani]

Hi
I've protected my route with Sanctum API Token as you describe, but I've a question: when I call route internally, in my code with the 'name()', I'd like to bypass the auth. What is the best practice?
Thank you.

[bhaidar]

Hey! Can you please validate the below? When using Sanctum API Tokens tokenCan() is used instead of Gates and can(). While when using Sanctum with Vue (for instance), Gates and can() are the ones used instead of tokenCan()? From what I understand, Sanctum SPA Auth makes use of Laravel Session, hence Gates are just natural to be used. While, Laravel API Tokens, is something else relying heavily on Token + Abilities. Thanks!

[repetitoraru]

Thanks a lot, Povilas! You helped so many people. One question. What can be wrong with the following? I made everything according to this video, but in the very end when in the controller I try to use auth()->user()->tokenCan() it falls because auth()->user() is null. Maybe someone else here can know? My API controller cannot see the user.

[MoawiaAlmardoud]

What is the best way to protect Vue page with Sanctum?

[nguyenhoa]

do you have any guide to build portal website using laravel and connect to this api?

[frank_core]

Is there a way where we can delete all tokens which are not used anymore using a scheduler?
Thank you in advance.

[diegoc]

but anyone with access to the public SPA can look at the requests made vis the browser console and steal that bearer token. How is this secure?

[mnafaykhan]

sir please help me i want to apply sanctum on my custom created model instead of user.php what I have to do kindly help me?

[raziburrahman]

I always follow your great tutorial videos. I learned lots of things from here. I developing a laravel vue spa project with laravel sanctum but when I Deploy my project on sub domain. I am getting 401 error. Can you please make a video on laravel sanctum project deploy on live server

[TechWizardBoctulus]

What's the sense of a "white list" of web tokens?

[agustinarroyosotomayor]

Great Tutorial. Is it possible to combine Sanctum API Tokens with Passport/JWT instead of Sanctum SPA Authentication ?

[birenjung]

I think the show function returns 403 status because token named categories-show is not made. Am I right?

[tomm]

Sad that there is no refresh token functionality