Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

buryo's avatar
Level 4

Consuming Your API With JavaScript

I'm setting up a new Laravel project, after watching some tutorials I found out the Laravel Passport Auth. I've walked through the Passport #Installation till #Frontend Quickstart, however I want to use Laravel's make:auth login and inside my project I want to use React as front-end. https://laravel.com/docs/5.8/passport#consuming-your-api-with-javascript

I found out that for First client application's there is no need for a manual JWT & OAuth implementation.

After loggin in to my application with the Auth::login, I found out even if I'm authenticated, I can't visit http://127.0.0.1:8900/api/user (which is automatically added by Laravel to routes\api.php)

I found a tutorials which %90 looks like what I need, but he's not getting 401. Altough we do the same things. https://www.youtube.com/watch?v=TVmUW-8-UN4

I have tried these:

  • config:cache, config:clear, cache:clear
  • adding inside EncryptCookiesprotected static $serialize = true;
  • added Passport::withoutCookieSerialization(); into AppServiceProvider boot method
// added HasApiTokens to App\User
// I see a `laravel_token` in my cookies when I log in

Route::middleware('api')->get('/user', function (Request $request) {
    return $request->user();
});

I want to be able to visit an API route only if I'm authenticated (the authentication must be done by the login system of php artisan make:auth

0 likes
11 replies
tokoiwesley's avatar

This problem may be due to a change in how Laravel handles cookie serialization. Which version of Laravel are you using?

tokoiwesley's avatar

Try adding Passport::withoutCookieSerialization(); in the boot method of the AppServiceProvider (app/Providers/AppServiceProvider.php) to see whether that solves the problem.

buryo's avatar
Level 4

@TOKOIWESLEY - I added Passport::withoutCookieSerialization(); in the boot method, did config:cache and migrate:fresh and restarted the server. Still getting unauthorized 401

tokoiwesley's avatar

Are you getting laravel_token in the response headers?

tokoiwesley's avatar

@BURYO - That's OK. It's supposed to be in the request headers and not response headers.

tokoiwesley's avatar
Level 11

@BURYO - Change this protected static $serialize = true; to

protected static $serialize = false;
buryo's avatar
Level 4

@TOKOIWESLEY - You are a lifesaver :D thank you! it worked immediatly! Can u also explain why this happend? So I can learn from it

Please or to participate in this conversation.