Laravel Sanctum and Laravel Passport are two tools for API authentication, suitable for different scenarios. 1. Sanctum is simpler and lighter, suitable for SPAs, mobile applications and basic token authentication; 2. Passport is a complete OAuth2 server that supports third-party access tokens, token revocation and fine-grained scope control. If you need the OAuth2 function, use Passport, otherwise Sanctum is more suitable. The settings process of the two are different: Sanctum needs to install, publish configuration, run migration, update user model and add middleware, and generate tokens through the createToken method; Passport needs to install, run migration, execute the passport:install command, update user model and register routes. When selecting, you should determine whether the advanced features of OAuth2 should be required based on the project requirements.

When building APIs with Laravel, securing them properly is cruel—especially if they're consumed by mobile apps or SPAs (Single Page Applications). Two common tools for this are Laravel Sanctum and Laravel Passport. Both can handle authentication, but they serve different use cases and have distinct setups.

Understanding the Differences: Sanctum vs. Passport

Laravel Sanctum and Passport both provide API authentication, but their approach is quite different.

• Sanctum is simpler and lightweight. It's great for SPAs, mobile apps, and simple token-based authentication.
• Passport is a full OAuth2 server, which means it supports more complex scenarios like third-party access tokens, token revocation, and granular scopes.

If you don't need full OAuth2 features, Sanctum is usually enough—and easier to set up.

Setting Up Sanctum in Your Laravel API

To secure your Laravel API with Sanctum, follow these steps:

1. Install Sanctum : Run composer require laravel/sanctum and publish the config file using php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider" .

2. Run Migrations : Sanctum needs a table to store tokens, so run php artisan migrate .

3. Update User Model : Add the HasApiTokens trait to your User model ( use Laravel\Sanctum\HasApiTokens; ).

4. Configure Middleware : In app/Http/Kernel.php , make sure \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class is added to the api middleware group.

5. Create Tokens : Use $user->createToken('token-name') to generate tokens. Return that token to the client after login.

6. Protect Routes : Use the auth:sanctum guard to protect your API routes.

One thing to note: Sanctum tokens don't expire by default. If you want short-lived tokens, enable that in the config and manage refresh logic on the client side.

How to Secure APIs Using Laravel Passport

If your app needs OAuth2 functionality (like allowing third-party services to authenticate), Passport is the better choice.

Here's how to get started:

• Install Passport : Run composer require laravel/passport and then php artisan migrate .
• Install JavaScript Dependencies : Run npm install passport passport-http-bearer if you're using Node.js for frontend.
• Run Passport Install Command : Execute php artisan passport:install . This generates encryption keys and creates OAuth clients needed for issuing tokens.
• Update User Model : Add the HasApiTokens trait from Passport and use the Laravel\Passport\HasApiTokens namespace.
• Add Passport Routes : In your AuthServiceProvider , call Passport::routes() inside the boot method.
• Set Auth Guard : In config/auth.php , set the api driver to passport .

With Passport, you can issue long-lived tokens, revoke them, and even allow users to grant access to third-party apps. However, this also adds complexity—so only go this route if you really need those features.

Choosing Between Sanctum and Passport

The decision really comes down to your project's requirements.

• Go with Sanctum if:

  • You're building a SPA or mobile app.
  • You don't need OAuth2 features like scopes or third-party access.
  • Simplicity and speed of setup matter.

• Choose Passport if:

  • You need full OAuth2 support.
  • You're planning to offer an API for third-party developers.
  • Token management beyond basic auth is required.

Both tools work well, but mixing them isn't recommended unless you have a very specific reason to do so.

Basically, start with Sanctum unless you know you'll need Passport's extra capabilities.

The above is the detailed content of Securing Laravel APIs with Sanctum or Passport Authentication. For more information, please follow other related articles on the PHP Chinese website!