Also, we looked at how it is different from Laravel Passport and when to use it. In this tutorial, we looked at what Laravel Sanctum is and what it does.

Otherwise, we should get user details as in the image below: If we try to access the /me endpoint with a valid token, we should get something similar to the image below: To login, make a POST request to with your email and password (in plain text format. Make sure that your password is at least 8 characters long. To create a new user, make a POST request to with a name, email, and password. Now, we can make the requests in Insomnia as in the following examples. The application should be running on and we can access the API on. We’ll do that by running the command below in our terminal: Let’s start by creating a new Laravel application.

Basic knowledge of using an HTTP client such as Insomnia.Īs you can see Laravel Sanctum does much more, but in this tutorial, we will be using Laravel Sanctum to create APIs.

In order to complete this tutorial, you will need the following:

Sanctum works with SPAs (Single Page Applications like Vue, Angular, and React) and supports mobile application authentication.

Sanctum is a featherweight, meaning it is light and simple to implement.

If you are not using that, then Sanctum is your go-to for issuing API tokens.

Passport is implemented with OAuth2 authentication.

Here are some reasons you might want to choose Sanctum over Passport: Laravel Sanctum poses as a simple alternative to the existing Laravel Passport package. It can be used to issue API Tokens to your users and authenticate Single Page Applications using Laravel’s session. Laravel Sanctum, formerly known as Airlock, is a Laravel package created for the authentication of Single Page Applications (SPAs), mobile applications, and basic token-based APIs.

Sanctum download