Level 23
can you try $user->createToken('token-name', ['server:update'])->plainTextToken; https://laravel.com/docs/8.x/sanctum#token-abilities
Jan 11, 2021
7
Level 5
How to Authorize API in Laravel 8
I am using Jetstream to authentication scraffold.
Now, I want to use Sanctum Package to Authorize my API.
But how will I save my token?
I didn't find any clear instruction.
In documentation there is a issuing system: https://laravel.com/docs/8.x/sanctum#issuing-mobile-api-tokens
But I want to do it while user will login I want to save the token.
How can I do it?
Level 5
But I want to pass this save this token into database with Login Method. Is it possible?
Level 80
@nafeeur10 Well what’s consuming the API? A web app? A mobile app? A third party?
Storing the token is a client-side concern, so it completely depends on what client technology you’re using as to how you would persist the token.
1 like
Level 5
@martinbean,
Well, I just building API. No interact with Client-Side. I want to secure my API. I want to save my token into database during user login. So that no unauthenticated user could get my API. Every request will be authenticated via token.
Level 80
@nafeeur10 An API is useless if there isn’t a client using it. Whatever is using your API is a client.
If you‘re saving a token to the database during authentication, then what’s the point of authenticating against an API? Just use session-based authentication.
1 like
Level 5
Actually, Client will use the API that's true. So that I am building API. :-P But the question is not related to Client Side.
https://laravel.com/docs/8.x/sanctum#issuing-mobile-api-tokens
Here token is saving to database?
$user->createToken($request->device_name)->plainTextToken;
I want to save this info during User login.
Level 80
@nafeeur10 It defeats the point of using token-based authentication if you’re just going to save it to a database though.
With Sanctum, you either get a token that you supply on every subsequent API request, or you get a cookie that authenticates requests. You don’t save tokens to a database.
You keep tokens in client-side storage and send it with each request. The server then identifies the user from the token, and whether the token is valid or not.
1 like
Please or to participate in this conversation.