Inertia project + sanctum authenticated API

Certainly! Here’s a breakdown of considerations and advice for your setup:

1. Combining Inertia (Web) and API (Mobile/Desktop) in One Laravel Project

This is a common approach and is supported well by Laravel. Many teams use a single Laravel backend to serve both a web frontend (via Inertia.js or Blade) and APIs for mobile/desktop clients.

2. Authentication: Sanctum for API, Session for Web

• Web (Inertia): Uses session-based authentication (default Laravel auth).
• API (Mobile/Desktop): Uses token-based authentication via Laravel Sanctum.

This is the recommended approach. Sanctum is designed to work alongside session-based auth, and Laravel handles this separation well.

3. Potential Pitfalls & Best Practices

• Route Grouping:
  Keep your web and API routes clearly separated in routes/web.php and routes/api.php. Use route middleware to enforce the correct authentication guard.

  // routes/web.php
  Route::middleware(['auth'])->group(function () {
      // Inertia routes
  });
  
  // routes/api.php
  Route::middleware(['auth:sanctum'])->group(function () {
      // API routes
  });
  

• CORS:
  Ensure your API is properly configured for CORS (Cross-Origin Resource Sharing) so mobile/desktop clients can access it.

• Rate Limiting:
  Protect your API routes with rate limiting to prevent abuse:

  Route::middleware(['auth:sanctum', 'throttle:api'])->group(function () {
      // API routes
  });
  

• User Model:
  If you need to distinguish between web and API users, consider adding a column or using Laravel’s guard system.

• Testing:
  Write tests for both web and API authentication flows to ensure they don’t interfere with each other.

4. Performance & Scaling

• Database:
  MySQL can handle significant traffic, but performance depends on query optimization, indexing, and hardware. Monitor slow queries and use Laravel’s query logging/profiling tools.

• Caching:
  Use Laravel’s caching (Redis, Memcached) for frequently accessed data to reduce DB load.

• Queueing:
  Offload heavy or slow tasks (emails, notifications, etc.) to queues.

• Horizontal Scaling:
  If traffic grows, consider scaling your app servers and database (read replicas, clustering).

5. Security

• API Tokens:
  Sanctum tokens should be stored securely on the client (never in localStorage for web, use secure storage for mobile).

• CSRF:
  Web routes are protected by CSRF middleware; API routes are not (since they use tokens).

6. Documentation

• Keep your API well-documented (Swagger/OpenAPI, Laravel API resources, etc.) so mobile/desktop teams can integrate smoothly.

---

Summary:
You’re on the right track! Many Laravel projects combine Inertia (web) and Sanctum (API) in a single codebase. Just keep your routes, authentication, and middleware clearly separated, monitor your database, and be proactive about performance and security. As traffic grows, you can scale both your app and database as needed.

If you have specific concerns or run into issues, feel free to ask!