Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Charrua's avatar

Which OAuth 2.0 flow should I use? Vue form and API

Hello, I'm new to OAuth and APIs. I have set my Laravel API endpoints to store and send responses for saving a resource. In other webpage I have a Vue public form for users to buy tickets and store them in the Laravel app.

If I use passport, what type of authorization flow (why, benefits) I need to use to authenticate all requests to my API? Thank you.

0 likes
5 replies
D9705996's avatar

The answer depends on how you plan to consume the API but it sounds like you want the users to login in the frontend which then queries your own backend. I would use the Password Grant type as its pretty simple - where the user supplies there username/password and if they are correct get a token back that they then use on subsequent requests.

Rather than trying to explain the differences between the types there is a good laravel news blog post on the subject

https://laravel-news.com/passport-grant-types

Charrua's avatar

@D9705996 - Great answer, thank you. The ticket form will be public and reachable by all guest users (eg domain.com/form), they will not need to login to fill and send the form. And my API will live on anotherdomain.com/api

Maybe I'm confused and is not the case to use authenticated API requests to my app because there is no login on the frontend... I thought on using authenticated requests to add some security to my API but maybe is not the use case here.

D9705996's avatar

@CHARRUA - To be honest if you don't need authentication then you don't really need passport as from the docs

Laravel makes API authentication a breeze using Laravel Passport

Charrua's avatar

@D9705996 - That is what I’m looking for now, if I need to authenticate or not... how can I resolve this? Any more ideas? How to determine if I need authentication to send the form data or not...

D9705996's avatar
D9705996
Best Answer
Level 51

@CHARRUA - This is a decision you need to decide yourself based on how you want your application to work. If you are happy that anyone can submit the form then you don;t need any authentication (I would recommend using something like reCaptcha to prevent automated scripts spamming you form.

There is a good lesson on laracasts on adding this.

If you do need user to login to be able to post the form then you will need an authentication workflow and if you are using passport the password grant should work well for you.

Please or to participate in this conversation.