Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

chrisgrim's avatar

Laravel api stripping user info

I am struggling to understand laravels api routes. I am setting up laravel cashier and the tutorial is telling me to put

Route::GET('/user/setup-intent', 'BillingController@getSetupIntent')->middleware('auth:api');

in the api routes file. Even if I am logged in, this gives me a 401 error. If I remove the middleware it allows me to access the billing controller, however if I try to do something like

use Auth;

public function getSetupIntent( Request $request ) {
        return Auth::id();  //test 
		//return $request->user()->createSetupIntent();
    }

it returns nothing. However, if I put the Route file into Web.php it will return the id. I am guessing there is a pretty important reason to use the api route with middleware. Can someone explain what is happening here?

0 likes
2 replies
Tippin's avatar
Tippin
Best Answer
Level 13

@chrisgrim Not sure why a tutorial is telling you to use an API route unless it is a tutorial for utilizing cashier over an API, like consuming within a mobile app. If you are not actually, intentionally, making an API, then stick your routes in web which I assume all your other routes reside in.

Just to explain a bit, you will get 401 because auth:api is the API guard, which by default, your auth.php config will not even have. Usually when you use an oauth solution like passport, or something like sanctum or JWT, then you would be using the API guard to authenticate based on headers / access tokens sent, not sessions. Hence, an API is stateless. And without prepping the guard, it will simply not work for you.

chrisgrim's avatar

Thank you for taking the time to explain it! That makes sense.

Please or to participate in this conversation.