Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

panthro's avatar

Sanctum - API Tokens or SPA Authentication

I see that with Sanctum you can use it for API Tokens or SPA Authentication.

I need to access my Laravel API from my SSR website, which should be used? It's not a single page application, yet I do not need to authorize each user, I just need to authorize the SSR site as a whole.

0 likes
4 replies
bugsysha's avatar

Not sure I fully understand. Seems like there are conflicting statements. What are you using for SSR? API is stateless so you have to "authenticate" with each request.

panthro's avatar

Sorry - it is just server side rendered website (via Nuxt), so its it correct that I will need to use Sanctums API tokens to access my laravel API that sits on another server and not the SPA Authentication?

martinbean's avatar

@panthro Why are you using an API in a server-rendered app? That’s wholly inefficient.

Instead of a user making a HTTP request, your application fetching the data it needs from a database and rendering it in a HTML view, the user instead needs to make a HTTP request, your server then makes its own HTTP request to your API, you then have to parse the API response to the send it back as a response from your app to the end user. You’ve essentially doubled your page load times.

Either build an API-powered SPA or build a server-rendered app. Don’t mix the two approaches.

panthro's avatar

i get that you are making extra requests with this approach but how else are you suppose to implement it?

I have a JS component (feed) that gets data, and is extended on infinte scroll with more data.

So there's going to be 2 x requests anyway with client side rendering, one for the page load and another to fill up the feed.

I would appreciate any pointers.

Please or to participate in this conversation.