Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Deekshith's avatar

Laravel passport client api middleware returns unauthenticated without public in URL

I am using laravel passport api for machine to machine authntication and it is working fine and this laravel project installed in a directory within wordpress project so i have added htaccess file in root of laravel project like below to remove the public from URL,

<Files ~ "\.(env|json|config.js|md|xml|gitignore|gitattributes|lock|editorconfig|yml|styleci.yml)$">
     Order allow,deny
     Deny from all
 </Files>
 Options -Indexes
 <Files ~ "(artisan|package.json|webpack.mix.js)$">
     Order allow,deny
     Deny from all
 </Files>
 <FilesMatch ".(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$">
     Require all denied
 </FilesMatch>
<ifmodule mod_rewrite.c>

    <ifmodule mod_negotiation.c>
        Options -MultiViews
    </ifmodule>

    RewriteEngine On

    RewriteCond %{REQUEST_FILENAME} -d [OR]
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ ^ [N]

    RewriteCond %{REQUEST_URI} (\.\w+$) [NC]
    RewriteRule ^(.*)$ public/

    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ server.php

</ifmodule>

and it is working fine if i run the website in browser like this,

https://www.example.com/subfolder

and in postman i have generated the access token like below,

https://www.example.com/subfolder/oauth/token

Above api returns the response of access token and i have used this token for other protected api's like below,

https://www.example.com/subfolder/api/post/2021/07/27/183923

and in header section i have added like below,

Authorization => Bearer access_token

above query returns unauthenticated

but if i add public to above url then it is working fine,

https://www.example.com/subfolder/public/api/post/2021/07/27/183923

Any help?

0 likes
0 replies

Please or to participate in this conversation.