Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

pn523's avatar
Level 2

Laravel microservices with sanctum

I am creating project with microsrevices in laravel and it will have database per service and it will use api gateway which will receive all the requests and than forward it to the microservices.

Problem is that if I separate users and auth mciroservices, than manually how can I verify token in sanctum as sanctum does not provide any method to verify the token and only route middleware auth:sanctum does that.

or should I keep users and auth microservices as one microservice ?

0 likes
12 replies
jlrdw's avatar

Just deal with API as needed, don't get lost in the microservice termanology.

I like this example:

  • A tech logs in at doctors office patient room.
  • Tech takes blood pressure records results, but tech has no access to other results
  • Doctor comes in, logs in, and pulls up your labs from another source
  • Probably pulled them up from a connected Lab via API.

So entry into other services / api's is done through authentication and authorization.

Same for a pet shelter:

An admin logs into shelters computer. Through authorization (on their system) enters some animals through an api to a larger adoption agency.

There are at least a couple of credentials required.

  • 1 A login in to system being used
  • 2 The token based Auth to outside. The "local system" i.e., doctors office or pet shelter is already "setup" with the api.

So access to the api (meaning that part of the MVC application) in doctors office or pet shelter is handled via normal laravel authentication.

This type of app is far different from a straight back and forth api between user and api. In that case it's token based only. A weather app is an example of that.

However if all back end is the same app you do not need an api. You only need an api to pull in some data from another back end.

1 like
pn523's avatar
Level 2

@jlrdw thank you for replying to my thread. But I am still not very clear about how would everything fit together.

martinbean's avatar

@pn523 Then microservices probably isn’t the right approach for your project.

jlrdw's avatar

@pn523 I would suggest some of the lessons from here, @jeffreyway has various lessons many are free.

But I am still not very clear about how would everything fit together.

You make a request to a service when some data is needed from that service. If it's your own api, same thing. Look at it like pulling in some outside data from somewhere.

There are some lessons on API's as well.

2 likes
pn523's avatar
Level 2

@martinbean thanks for replying to my therad.

After R&D I have found microservice architecture to be more suitable to my project than a monolith, so I need to any how figure it out.

pn523's avatar
Level 2

@jlrdw thanks for replying. I searched for microservice tutorial on laracasts but could not find one. I already know about building apis in laravel and calling one api from another using guzzle Http, but designing microservice is the working point. for me. Can you suggest me any course about microservice specific in laracasts? maybe II missed some courses in laracasts.

I was doing R&D and found that many are suggesting that I use Api gateway as Auth by installing passport in Api gateway itself where I can check for the token validation before letting request to proceed further and also I can check for authorization there itself.

Since I want to keep users and Api gateway as different microservices so I was wondering if I can share users database with Api gateway because passport needs users table.

I have following questions:

  1. Do I need to write all routes from all microservices in API gateway ? if yes than that means routes will be written twice i.e. in API gateway and individual microservice as well, so how to write routes in API gateway exactly ?

  2. If I want to combine data from different microservices into one than I think it needs to be done in api gateway, am I thinking it correct ?

  3. How to authenticate request between microservices as I want it to be secure internally too, should I use the public and private key feature that is provided in passport ? if yes how to verify the public and private keys when request arrives in each microservice ?

  4. Can Api gateway have db access to it ? is it secure ?

Thanks in advance

jlrdw's avatar

@pn523 here is another post where someone implemented microservices.

https://laracasts.com/discuss/channels/general-discussion/microservices-using-laravel

Edit:

Also microservices are not framework agnostic, one service may be a backend where java is the language, another .net core, another php, etc.

If all data is your data (not an outside company) then in such a case it makes no sense to use microservices.

You are basically splitting up your app to different servers or backends. You only need that in a situation where two or more apps are completely unrelated, yet some company needs some data from app A and another time needs data from app B. But if it's all your data they need then I would not worry about microservices. You probably just need an API so users can get certain data from the backend.

Again using a doctors office as an example:

  • They get lab results from outside source
  • They do some online banking
  • They get MRI results from another place

So all the above in not one app.

You need to chart out what you have and place it here, the chances are microservices does not apply. But only you know what your app needs.

1 like
pn523's avatar
Level 2

I will be making School management system. Because it is such a huge project so I was thinking about implementing microservices by keeping in mind that microservices are better scalable and many other pros that comes with it as different clients can have different requirements and feature requests can come from client in the future but also I see many cons like 'complicated architecture','high server running costs' etc.

I chose Microservices at first by thinking about scalability, new features introduction without downing the entire site and many more.

For a huge project like 'School Management System' should I implement 'Microservices' architecture or 'Monolith' ? What are your thoughts ?

Thanks in advance

martinbean's avatar

@pn523 You should only consider microservices when you have clear boundaries between functionality. If you find one service relies on data from another, then microservices isn’t the answer.

Microservices aren’t a way to carve your application up into arbitrary modules, because once you do you no longer have one application to develop, deploy, scale; you now have multiple applications to develop, deploy, scale.

1 like
pn523's avatar
Level 2

@martinbean thanks for replying.

Can you please explain about consider microservices when you have clear boundaries between functionality. as I am new in microservices domain ?

Also, what is your suggestion for a huge project like School Management System. Is monolith architecture suitable for it ?

I was thinking about below questions:

  1. In monolith if a new module need to be introduced than I have to down the entire website for that, where as I think that sort of problem is better managed by microservice as there will be separate module, so only that part of the website will be down

  2. In monolith if an unexpected error occurs it can down the entire application, so how can I manage that in monolith if that is the architecture to go with ?

Thanks in advance

martinbean's avatar

Can you please explain about consider microservices when you have clear boundaries between functionality. as I am new in microservices domain ?

@pn523 Exactly that. If you have one service that relies on data from another service, then you don’t have clear boundaries and you’re just splitting your code across “services” for no reason whatsoever other than you think “microservices” is a cool pattern, and you wanted to implement them even though they’re not an appropriate solution for your project.

Also, what is your suggestion for a huge project like School Management System. Is monolith architecture suitable for it ?

I don’t know. I have no idea about what makes a “school management system”. But many projects use microservices that don’t need microservices.

In monolith if a new module need to be introduced than I have to down the entire website for that, where as I think that sort of problem is better managed by microservice as there will be separate module, so only that part of the website will be down

No, you don’t. Why on earth do you have to “take down” the entire website to add a new module? You build the module locally. You then deploy the new module.

In monolith if an unexpected error occurs it can down the entire application, so how can I manage that in monolith if that is the architecture to go with ?

And that can’t happen with microservices? If one service goes down that others rely on, you’re going to have the same problem. So it’s important to have good error tracking (and good test coverage) so you can identify issues and rectify them quickly.

1 like
jlrdw's avatar

@pn523 also since you seem to be very intrigued by microservices, then just implement microservices on a test application and give it a try.

But I agree with the above answer that most people who think they need microservices do not need microservices.

Chances are you will Implement some microservices in a school system program anyway because some outside data will be needed. Probably something from the State.

Most microservices implemented aren't something you even program, it's on another server from another company.

Also I suggest looking up some real World examples of microservices.

2 likes

Please or to participate in this conversation.