sanctum return unauthenticted after login.

.env config file -

SESSION_DRIVER=cookie
SESSION_LIFETIME=120
SESSION_ENCRYPT=false
SESSION_PATH=/
SANCTUM_STATEFUL_DOMAINS=localhost:8080,127.0.0.1:8080,localhost:3000,127.0.0.1:3000
SESSION_DOMAIN=localhost

axios file -

import axios from 'axios';
const   axiosInstance = axios.create({
        baseURL: process.env.NEXT_PUBLIC_API_URL,
        withCredentials: true,
        withXSRFToken : true,
      });
      
export default axiosInstance;

route api file -

Route::get('/user', function (Request $request) {
    return $request->user();
})->middleware('auth:sanctum');


Route::post('/register',[UserController::class,'register']);
Route::post('/login',[UserController::class,'login']);

Route::group(['middleware' => ['auth:sanctum']],function() {
    Route::get('/products',[ProductController::class,'allProducts']);
});

app.php file -

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        api: __DIR__.'/../routes/api.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        $middleware->statefulApi();
    })
    ->withExceptions(function (Exceptions $exceptions) {
        //
    })->create();

So after login i can not access api/products route. its return unauthenticated . so anyone know why is this happening . Its seems file configuration is fine. and at first i call sanctum/csrf-cookie url and its sets session and cookie to the browser and every request the and cookie is being sent to laravel. I still don't know what is the issue here.