Laravel API authentication for Web & Mobile

@lianmaymesi You’ve asked about three times now. The Sanctum docs clearly state that you can use both API token-based authentication and cookie-based authentication.

So, you can build a single API, add the auth:sanctum middleware to your API routes, and then have your web app authenticate use cookies and your mobile apps authenticate using tokens.

For anyone else stumbling on this old thread while trying to figure out more details on how this actually works, the EnsureFrontendRequestsAreStateful middleware in sanctum (https://github.com/laravel/sanctum/blob/3.x/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php) checks for the existence of the domain in the origin/referer among the http request headers:

        $domain = $request->headers->get('referer') ?: $request->headers->get('origin');
        if (is_null($domain)) {
            return false;
        }

And then skips setting the session/cookies and csrf token checks for requests from mobile apps:

        return (new Pipeline(app()))->send($request)->through(static::fromFrontend($request) ? [
            function ($request, $next) {
                $request->attributes->set('sanctum', true);

                return $next($request);
            },
            config('sanctum.middleware.encrypt_cookies', \Illuminate\Cookie\Middleware\EncryptCookies::class),
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            config('sanctum.middleware.verify_csrf_token', \Illuminate\Foundation\Http\Middleware\VerifyCsrfToken::class),
        ] : [])->then(function ($request) use ($next) {

I understand that the original poster (OP) is seeking clarification on the specifics of a login API.

In the context of a login API, the standard practice is to utilize the "web guard" and return a Sanctum token as part of the response. However, a challenge arises in the login API process—it either requires the CSRF token, which can be obtained using the /sanctum/csrf-token endpoint (though this involves managing cookies and fetching the token), or it necessitates excluding the login route from the CSRF verification middleware.

An alternative approach involves creating a new route (/api/login), where the username and password can be authenticated, and a Sanctum token can be issued. Subsequently, this Sanctum token can be utilized for authentication in other APIs. It's important to note that this open route (/api/login) lacks CSRF protection, similar to other API routes.