In order to authenticate, your SPA and API must share the same top-level domain. However, they may be placed on different subdomains.
In your case, you have two different domains: localhost and react.test
You have to change them to have the same domain: laravel.test and react.laravel.test
Also you need to know about proper session configuration in config/session.php: