Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

benr1804's avatar

Multi-auth guards, Laravel Passport and user roles together

Hello,

I have a application which has an admin/ namespace directory which uses the laravel session guard. I also have an /api namespace directory which uses the laravel passport guard.

I also am using the CreateFreshApiToken middleware which ships with Laravel Passport, so that my admin can also access the api from within the admin back-office.

One of my modules I have is to managed the back office users and their roles within the system. I have an api call /api/user/ which loads all my back office users. For this route I have some logic which takes a look at the logged in user (using Auth::check()) and a custom method which checks whether my session user is a super user:

   /**
     * Return all the users
     * @return object
     */
    public function all()
    {
        // If the current user is not a super user, omit the super users from the resultset
        if (Auth::check()->isSuperUser()) {
            return $this->queryBuilder()
                ->with('roles')
                ->whereHas('roles', function($q){
                    $q->where('id', 1);
                }, '!=', 1)
                ->get();
        } else {
            return $this->queryBuilder()->with('roles')->get();
        }
    }

The issue is that when I use this route via the Laravel Passport guard, there is no concept of a user when calling Auth::check(). It simply returns true, therefore I cannot check the user is a super user because the concept doesnt exist.

Is there a way I can get this route working for both the admin session guard and api passport guard? Is there anyway of knowing whether the request is from the actual admin itself, or whether it is an api request via access token?

Many thanks

0 likes
0 replies

Please or to participate in this conversation.