Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

hnccox's avatar

API Keys vs Personal Access Tokens

I am currently working on a project that will let users add their own domains to my application.

Multiple users can administer a single domain registration.

These domains should be able to communicate with my API endpoints. Should I be using a "Personal Access Token" for these third party domains, using the Laravel Sanctum package?

Or should I create a separate API Key table instead? I do like the abilities functionality that Laravel Sanctum provides, but these are not really "Personal Access Tokens" as no specific user is coupled with these requests.

Does it matter or should I just use the personal_access_tokens table? The token_type will be set to App\Model\Domain anyway.

0 likes
1 reply
enoch91's avatar

@hnccox Laravel Sanctum seems like a suitable approach. However, since these tokens are not tied to specific users but rather to domains, you may need to make some adjustments.

Please or to participate in this conversation.