Laravel Sanctum API Authentication: A Simple Beginner’s Guide

Dilip Published: Categories: API · Laravel

When building an API in Laravel, one of the most common ways to authenticate users is by using Laravel Sanctum.

Many beginners have questions like:

  • Do I need an AuthController?
  • Do I store tokens manually?
  • How does login work?
  • How do I protect API routes?

This guide answers all of those questions in a simple way.

What is Laravel Sanctum?

Laravel Sanctum provides a simple token-based authentication system for APIs.

The basic flow looks like this:

User Login
    ↓
Laravel Creates Token
    ↓
Token Stored in Database
    ↓
Frontend Receives Token
    ↓
Frontend Sends Token with Requests
    ↓
Laravel Verifies Token
    ↓
Protected APIs Become Accessible

Step 1: Install Sanctum

In newer Laravel versions:

php artisan install:api

Then run migrations:

php artisan migrate

This creates the table:

personal_access_tokens

This table stores all API tokens.

Step 2: Add HasApiTokens to User Model

Open your User model:

use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens;
}

This gives the User model the ability to create and manage API tokens.

Step 3: Create an Auth Controller

Yes, you usually create an AuthController manually.

Example:

php artisan make:controller Api/AuthController

This controller commonly contains:

  • Register
  • Login
  • Logout
  • Current User Profile

Step 4: Login and Create a Token

When a user logs in successfully:

if (!Auth::attempt($request->only('email', 'password'))) {
    return response()->json([
        'message' => 'Invalid credentials'
    ], 401);
}

$user = Auth::user();

$token = $user->createToken('api-token')->plainTextToken;

return response()->json([
    'token' => $token
]);

What happens here?

  1. Laravel checks the credentials.
  2. Sanctum creates a token.
  3. The token is stored automatically in the database.
  4. The token is returned to the frontend.

Step 5: Do We Store Tokens Manually?

No.

This is one of the best things about Sanctum.

When you run:

$user->createToken('api-token');

Sanctum automatically stores the token inside:

personal_access_tokens

You don’t need to write any database code yourself.

Step 6: Frontend Stores the Token

After login, the frontend receives:

{
    "token": "1|abcxyz123..."
}

The frontend should store this token.

Common places:

  • Local Storage
  • Session Storage
  • Secure Cookies (recommended for some applications)

Step 7: Send Token with Every Request

Whenever the frontend calls a protected API, it sends:

Authorization: Bearer TOKEN_HERE

Example:

GET /api/profile

Authorization: Bearer 1|abcxyz123...

Laravel reads this token and identifies the user.

Step 8: Protect Routes with Sanctum Middleware

Protected routes should use:

Route::middleware('auth:sanctum')->group(function () {

    Route::get('/profile', [UserController::class, 'profile']);

    Route::post('/logout', [AuthController::class, 'logout']);

});

What does this middleware do?

No Token      → Access Denied
Invalid Token → Access Denied
Valid Token   → Access Granted

Step 9: Get the Logged-In User

Inside protected routes:

$user = auth()->user();

or

$user = $request->user();

Laravel automatically provides the authenticated user.

Step 10: Logout

To log out:

public function logout(Request $request)
{
    $request->user()->currentAccessToken()->delete();

    return response()->json([
        'message' => 'Logged out successfully'
    ]);
}

This removes the current token from the database.

After that, the token can no longer access protected APIs.

Complete Sanctum Authentication Flow

Register User
      ↓
Login
      ↓
Verify Credentials
      ↓
Create Token
      ↓
Store Token Automatically
      ↓
Return Token to Frontend
      ↓
Frontend Sends Bearer Token
      ↓
auth:sanctum Middleware Validates Token
      ↓
Access Protected Routes
      ↓
Logout Deletes Token

Quick Checklist

✅ Install Sanctum

php artisan install:api

✅ Run migrations

php artisan migrate

✅ Add HasApiTokens to User model

✅ Create AuthController

✅ Generate token using createToken()

✅ Return token to frontend

✅ Protect routes using auth:sanctum

✅ Send Bearer token from frontend

✅ Delete token on logout

Conclusion

Laravel Sanctum makes API authentication extremely simple. You don’t need to manually create token tables, hash tokens, or build a custom authentication system.

The typical workflow is:

Login → Generate Token → Store Automatically → Send Bearer Token → Protect Routes with auth:sanctum → Logout by Deleting Token

Once you understand this flow, building secure REST APIs in Laravel becomes much easier.