Laravel Sanctum

1php artisan install:api

1use Laravel\Sanctum\PersonalAccessToken as SanctumPersonalAccessToken;
2 
3class PersonalAccessToken extends SanctumPersonalAccessToken
4{
5    // ...
6}

 1use App\Models\Sanctum\PersonalAccessToken;
 2use Laravel\Sanctum\Sanctum;
 3 
 4/**
 5 * Bootstrap any application services.
 6 */
 7public function boot(): void
 8{
 9    Sanctum::usePersonalAccessTokenModel(PersonalAccessToken::class);
10}

1use Laravel\Sanctum\HasApiTokens;
2 
3class User extends Authenticatable
4{
5    use HasApiTokens, HasFactory, Notifiable;
6}

1use Illuminate\Http\Request;
2 
3Route::post('/tokens/create', function (Request $request) {
4    $token = $request->user()->createToken($request->token_name);
5 
6    return ['token' => $token->plainTextToken];
7});

1foreach ($user->tokens as $token) {
2    // ...
3}

1return $user->createToken('token-name', ['server:update'])->plainTextToken;

1if ($user->tokenCan('server:update')) {
2    // ...
3}
4 
5if ($user->tokenCant('server:update')) {
6    // ...
7}

1use Laravel\Sanctum\Http\Middleware\CheckAbilities;
2use Laravel\Sanctum\Http\Middleware\CheckForAnyAbility;
3 
4->withMiddleware(function (Middleware $middleware) {
5    $middleware->alias([
6        'abilities' => CheckAbilities::class,
7        'ability' => CheckForAnyAbility::class,
8    ]);
9})

1Route::get('/orders', function () {
2    // Token has both "check-status" and "place-orders" abilities...
3})->middleware(['auth:sanctum', 'abilities:check-status,place-orders']);

1Route::get('/orders', function () {
2    // Token has the "check-status" or "place-orders" ability...
3})->middleware(['auth:sanctum', 'ability:check-status,place-orders']);

1return $request->user()->id === $server->user_id &&
2       $request->user()->tokenCan('server:update')

1use Illuminate\Http\Request;
2 
3Route::get('/user', function (Request $request) {
4    return $request->user();
5})->middleware('auth:sanctum');

1// Revoke all tokens...
2$user->tokens()->delete();
3 
4// Revoke the token that was used to authenticate the current request...
5$request->user()->currentAccessToken()->delete();
6 
7// Revoke a specific token...
8$user->tokens()->where('id', $tokenId)->delete();

1'expiration' => 525600,

1return $user->createToken(
2    'token-name', ['*'], now()->addWeek()
3)->plainTextToken;

1use Illuminate\Support\Facades\Schedule;
2 
3Schedule::command('sanctum:prune-expired --hours=24')->daily();

1->withMiddleware(function (Middleware $middleware) {
2    $middleware->statefulApi();
3})

1php artisan config:publish cors

1axios.defaults.withCredentials = true;
2axios.defaults.withXSRFToken = true;

1'domain' => '.domain.com',

1axios.get('/sanctum/csrf-cookie').then(response => {
2    // Login...
3});

1use Illuminate\Http\Request;
2 
3Route::get('/user', function (Request $request) {
4    return $request->user();
5})->middleware('auth:sanctum');

1return Application::configure(basePath: dirname(__DIR__))
2    ->withRouting(
3        web: __DIR__.'/../routes/web.php',
4        // ...
5    )
6    ->withBroadcasting(
7        __DIR__.'/../routes/channels.php',
8        ['prefix' => 'api', 'middleware' => ['api', 'auth:sanctum']],
9    )

 1window.Echo = new Echo({
 2    broadcaster: "pusher",
 3    cluster: import.meta.env.VITE_PUSHER_APP_CLUSTER,
 4    encrypted: true,
 5    key: import.meta.env.VITE_PUSHER_APP_KEY,
 6    authorizer: (channel, options) => {
 7        return {
 8            authorize: (socketId, callback) => {
 9                axios.post('/api/broadcasting/auth', {
10                    socket_id: socketId,
11                    channel_name: channel.name
12                })
13                .then(response => {
14                    callback(false, response.data);
15                })
16                .catch(error => {
17                    callback(true, error);
18                });
19            }
20        };
21    },
22})

 1use App\Models\User;
 2use Illuminate\Http\Request;
 3use Illuminate\Support\Facades\Hash;
 4use Illuminate\Validation\ValidationException;
 5 
 6Route::post('/sanctum/token', function (Request $request) {
 7    $request->validate([
 8        'email' => 'required|email',
 9        'password' => 'required',
10        'device_name' => 'required',
11    ]);
12 
13    $user = User::where('email', $request->email)->first();
14 
15    if (! $user || ! Hash::check($request->password, $user->password)) {
16        throw ValidationException::withMessages([
17            'email' => ['The provided credentials are incorrect.'],
18        ]);
19    }
20 
21    return $user->createToken($request->device_name)->plainTextToken;
22});

1Route::get('/user', function (Request $request) {
2    return $request->user();
3})->middleware('auth:sanctum');

1// Revoke all tokens...
2$user->tokens()->delete();
3 
4// Revoke a specific token...
5$user->tokens()->where('id', $tokenId)->delete();

1Sanctum::actingAs(
2    User::factory()->create(),
3    ['*']
4);