Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

ncklrs's avatar

Spark API returning a login page not 401

I am new to Spark and working to write a few API endpoints.

I am doing some tests with Postman and when I do not send the API key it returns the Login Page and not a 401 Error.

I am trying to locate where to fix this in the app structure.

0 likes
8 replies
Cronix's avatar

What does you api.php routes look like?

when I do not send the API key

Sounds like they are in the auth:api route group then?

ncklrs's avatar

Yes I have them in a route group


Route::group([
    'middleware' => 'auth:api'
], function () {
    //
    Route::get('sample', function(){
       return  ['sample' => 'You got a sample'];
    });
    Route::post('sample', function (){
       return ['sample' => 'successful sample post'];
    });
});

Cronix's avatar

Well, I was hinting at it... but if you don't want them to be required to use the api key or be authenticated, they shouldn't be in that route group that is requiring it.

Route::group([
    'middleware' => 'auth:api' // required to be authenticated and pass api key
],
ncklrs's avatar

Thanks Cronix. I do want them to be required, I just would have thought it might automatically send and unauthorized error and not return a login page.

I am just looking to understand some of the hidden structure I suppose in Spark.

jhull's avatar

This has been driving me crazy for days now. App worked great with last year's Laravel/Spark combo. Tried upgrading to latest and greatest this week and now I'm getting 401s.

Even tried base installation Laravel 5.7 and Spark 7.0.2 and put this one route in:

Route::group([
    'middleware' => 'auth:api'
], function () {
    Route::get('/test', function () {
        return ['name' => 'taylor otwell'];
    });
});

and this for home.js:

Vue.component('home', {
    props: ['user'],

    mounted() {
        axios.get('/api/test').then(response => {
            console.log(response.data);
        });
    },
});

And I get 401 Unauthorized in the console and logged out. $usesApi is set to True...

Shouldn't it work with only these two simple modifications? Or am I missing something?

Please or to participate in this conversation.