API Authentication: Sanctum and Passport

<?php
// routes/api.php (Bookshelf)
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Route;
use Illuminate\Validation\ValidationException;

Route::get('/user', fn (Request $request) => $request->user()->only('id', 'name'))->middleware('auth:sanctum');

// issue a token to a mobile app or script
Route::post('/tokens', function (Request $request) {
    $data = $request->validate(['email' => 'required|email', 'password' => ['required'], 'device' => 'required|string|max:60']);
    $user = User::where('email', $data['email'])->first();

    if (! $user || ! Hash::check($data['password'], $user->password)) {
        throw ValidationException::withMessages(['email' => __('auth.failed')]);
    }

    $token = $user->createToken($data['device'], abilities: ['loans:read'], expiresAt: now()->plus(days: 30));

    return ['token' => $token->plainTextToken, 'expires_at' => $token->accessToken->expires_at];
})->middleware('throttle:6,1');

Route::middleware('auth:sanctum')->group(function () {
    Route::get('/loans', fn (Request $request) => $request->user()->loans()->get(['id', 'book_id', 'due_at']))
        ->middleware('abilities:loans:read');
    Route::post('/loans', fn () => ['created' => true])->middleware('abilities:loans:write');
    Route::delete('/tokens/current', function (Request $request) {
        $request->user()->currentAccessToken()->delete();                // log this device out

        return response()->noContent();
    });
});

$ curl -s -H 'Accept: application/json' -d 'email=ada@example.com&password=…&device=ada-phone' localhost:8000/api/tokens
{"token":"3|…","expires_at":"2026-11-04T21:24:08.000000Z"}
token shape: id 3 + | 48 chars
personal_access_tokens row: {"name":"ada-phone","abilities":"[\"loans:read\"]","expires_at":"2026-11-04 21:24:08","last_used_at":null}, token column 64 chars

$ curl -s -H "Authorization: Bearer $TOKEN" -w ' %{http_code}\n' localhost:8000/api/loans
[] 200
$ curl -s -H "Authorization: Bearer $TOKEN" -X POST -w ' %{http_code}\n' localhost:8000/api/loans
{"message": "Invalid ability provided."} 403
$ curl -s -X DELETE -H "Authorization: Bearer $TOKEN" -w '%{http_code}\n' localhost:8000/api/tokens/current
204
$ curl -s -H "Authorization: Bearer $TOKEN" -w ' %{http_code}\n' localhost:8000/api/user
{"message":"Unauthenticated."} 401

$ curl -s -c jar -b jar -H 'Referer: http://localhost:8000/' -w 'csrf-cookie %{http_code}\n' localhost:8000/sanctum/csrf-cookie
csrf-cookie 204                                              # sets XSRF-TOKEN and laravel-session
$ curl -s -c jar -b jar -H 'Referer: http://localhost:8000/' -H "X-XSRF-TOKEN: $XSRF" -d 'email=ada@example.com&password=…' -w 'login %{http_code}\n' localhost:8000/login
login 302
$ curl -s -b jar -H 'Referer: http://localhost:8000/' localhost:8000/api/user
{"id":1,"name":"Ada Reader"} 200
$ curl -s -b jar localhost:8000/api/user                       # no Referer/Origin: not treated as the SPA
{"message":"Unauthenticated."} 401
$ curl -s -b jar -H 'Referer: http://evil.example/' localhost:8000/api/user
{"message":"Unauthenticated."} 401
$ curl -s -b jar -H 'Referer: http://localhost:8000/' -X POST localhost:8000/api/loans
419
$ curl -s -b jar -H 'Referer: http://localhost:8000/' -H "X-XSRF-TOKEN: $XSRF" -X POST localhost:8000/api/loans
{"created":true} 200

<?php
// tests/Feature/ApiTokenTest.php
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Laravel\Sanctum\Sanctum;

uses(RefreshDatabase::class);

it('limits a token to its abilities', function () {
    Sanctum::actingAs(User::factory()->create(), ['loans:read']);

    $this->getJson('/api/loans')->assertOk();
    $this->postJson('/api/loans')->assertForbidden();
});

it('rejects an expired token', function () {
    $user = User::factory()->create();
    $token = $user->createToken('old-phone', ['loans:read'], now()->minus(minutes: 1))->plainTextToken;

    $this->withToken($token)->getJson('/api/user')->assertUnauthorized();
});

it('stores only a hash of the token', function () {
    $plain = User::factory()->create()->createToken('cli')->plainTextToken;
    [$id, $secret] = explode('|', $plain);

    $this->assertDatabaseHas('personal_access_tokens', ['id' => $id, 'token' => hash('sha256', $secret)]);
    $this->assertDatabaseMissing('personal_access_tokens', ['token' => $secret]);
});

$ php artisan test --filter=ApiTokenTest
  ✓ it limits a token to its abilities                                   0.22s
  ✓ it rejects an expired token                                          0.02s
  ✓ it stores only a hash of the token                                   0.01s
  Tests:    3 passed (5 assertions)

<?php
// app/Providers/AppServiceProvider.php, in boot() (Passport application)
use Laravel\Passport\Passport;

Passport::tokensCan([
    'loans:read' => 'See your loans',
    'loans:write' => 'Borrow and return books',
]);
Passport::authorizationView('oauth.authorize');   // Passport 13 ships no views
Passport::tokensExpireIn(now()->plus(hours: 1));
Passport::refreshTokensExpireIn(now()->plus(days: 30));

<?php
// routes/api.php (Passport application); config/auth.php has 'api' => ['driver' => 'passport', 'provider' => 'users']
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use Laravel\Passport\Http\Middleware\CheckToken;
use Laravel\Passport\Http\Middleware\EnsureClientIsResourceOwner;

Route::get('/user', fn (Request $request) => $request->user()->only('id', 'email'))->middleware(['auth:api', CheckToken::using('loans:read')]);
Route::get('/catalogue-sync', fn () => ['books' => 4])->middleware(EnsureClientIsResourceOwner::class);   // machine-to-machine