Laravel Sanctum is a lightweight API certification system suitable for front-end and back-end separation projects. 1. The installation requires Laravel 7.x or above. Install and publish configuration files and migration files through Composer. Run the migration and configure the domain name and stateful settings as needed. 2. User login can generate a simple token or a personalized token with permissions, and use the createToken method to get the plainTextToken and return it to the front end. 3. To protect API routes, you need to add the auth:sanctum middleware and manually call the tokenCan method to verify permissions. 4. Delete the current or all tokens when logging out, and the front-end needs to clear the saved tokens.
Laravel Sanctum is a lightweight authentication system that is especially suitable for building API authentication. It is not as complicated as Passport and does not require a full OAuth process. It is very suitable for projects that are separated from front and back ends, such as Vue, React or mobile applications.

Here are some key steps and precautions to help you quickly set up Laravel Sanctum's API certification.

1. Installation and basic configuration
First make sure you have created a Laravel project and the version is 7.x or above (the latest stable version is recommended).
Install Sanctum:

composer requires laravel/sanctum
Publish configuration files and migrate files:
php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"
Run the migration:
php artisan migrate
If you plan to use Sanctum to do SPA login (such as Vue front-end), you also need to set the allowed domain name in
config/sanctum.php
and enable thestateful
settings.
2. User login and generate tokens
Sanctum supports two token modes: simple token and revocable personalized token .
If you just want to make a simple login interface, you can generate a token like this:
use Illuminate\Support\Facades\Auth; $user = Auth::user(); $token = $user->createToken('auth_token')->plainTextToken;
Return this token to the front-end, and then bring Authorization: Bearer {token}
for each request.
If you want to support revoke tokens or generate different permissions tokens for different devices, you can use:
$token = $user->createToken('Mobile App', ['read', 'write']);
Then get the value through $token->plainTextToken
.
3. Protect your API routing
In routes/api.php
, use auth:sanctum
middleware to protect the route:
Route::middleware('auth:sanctum')->get('/user', function (Request $request) { return $request->user(); });
Note: By default, Sanctum does not check whether token has specific permissions unless you manually call $request->user()->tokenCan('read')
to determine.
4. Log out with Token
Log out of the token of the current user:
$request->user()->currentAccessToken()->delete();
If you want to log out all tokens at once:
$request->user()->tokens()->delete();
These operations are simple, but what is easy to ignore is that you need to clear the saved token on the front end, otherwise you will still bring the old token with the next request.
Basically that's it. The design goal of Sanctum is to be simple and direct, without complex configurations to complete API authentication. As long as you pay attention to the middleware and token creation and destruction points, you will basically not get into pitfalls.
The above is the detailed content of Setting up API Authentication with Laravel Sanctum?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

In Laravel, routing is the entry point of the application that defines the response logic when a client requests a specific URI. The route maps the URL to the corresponding processing code, which usually contains HTTP methods, URIs, and actions (closures or controller methods). 1. Basic structure of route definition: bind requests using Route::verb('/uri',action); 2. Supports multiple HTTP verbs such as GET, POST, PUT, etc.; 3. Dynamic parameters can be defined through {param} and data can be passed; 4. Routes can be named to generate URLs or redirects; 5. Use grouping functions to uniformly add prefixes, middleware and other sharing settings; 6. Routing files are divided into web.php, ap according to their purpose

InLaravel,policiesorganizeauthorizationlogicformodelactions.1.Policiesareclasseswithmethodslikeview,create,update,anddeletethatreturntrueorfalsebasedonuserpermissions.2.Toregisterapolicy,mapthemodeltoitspolicyinthe$policiesarrayofAuthServiceProvider.

To create new records in the database using Eloquent, there are four main methods: 1. Use the create method to quickly create records by passing in the attribute array, such as User::create(['name'=>'JohnDoe','email'=>'john@example.com']); 2. Use the save method to manually instantiate the model and assign values ??to save one by one, which is suitable for scenarios where conditional assignment or extra logic is required; 3. Use firstOrCreate to find or create records based on search conditions to avoid duplicate data; 4. Use updateOrCreate to find records and update, if not, create them, which is suitable for processing imported data, etc., which may be repetitive.

Thephpartisandb:seedcommandinLaravelisusedtopopulatethedatabasewithtestordefaultdata.1.Itexecutestherun()methodinseederclasseslocatedin/database/seeders.2.Developerscanrunallseeders,aspecificseederusing--class,ortruncatetablesbeforeseedingwith--trunc

Artisan is a command line tool of Laravel to improve development efficiency. Its core functions include: 1. Generate code structures, such as controllers, models, etc., and automatically create files through make: controller and other commands; 2. Manage database migration and fill, use migrate to run migration, and db:seed to fill data; 3. Support custom commands, such as make:command creation command class to implement business logic encapsulation; 4. Provide debugging and environment management functions, such as key:generate to generate keys, and serve to start the development server. Proficiency in using Artisan can significantly improve Laravel development efficiency.

Yes,youcaninstallLaravelonanyoperatingsystembyfollowingthesesteps:1.InstallPHPandrequiredextensionslikembstring,openssl,andxmlusingtoolslikeXAMPPonWindows,HomebrewonmacOS,oraptonLinux;2.InstallComposer,usinganinstalleronWindowsorterminalcommandsonmac

Defining a method (also known as an action) in a controller is to tell the application what to do when someone visits a specific URL. These methods usually process requests, process data, and return responses such as HTML pages or JSON. Understanding the basic structure: Most web frameworks (such as RubyonRails, Laravel, or SpringMVC) use controllers to group related operations. Methods within each controller usually correspond to a route, i.e. the URL path that someone can access. For example, there may be the following methods in PostsController: 1.index() – display post list; 2.show() – display individual posts; 3.create() – handle creating new posts; 4.u

ToruntestsinLaraveleffectively,usethephpartisantestcommandwhichsimplifiesPHPUnitusage.1.Setupa.env.testingfileandconfigurephpunit.xmltouseatestdatabaselikeSQLite.2.Generatetestfilesusingphpartisanmake:test,using--unitforunittests.3.Writetestswithmeth
