laravel
Laravel Sanctum in Production: API Tokens, Abilities and SPA Sessions
Sanctum is two unrelated authentication mechanisms sharing one package name, and almost every tutorial only covers half of one of them. This guide builds a real Orders API end to end: scoped tokens, an ability vocabulary that survives a year of growth, the tokenCan() hole nobody warns you about, expiry and pruning, full SPA cookie auth, per-token rate limiting, and Pest tests for all of it.
22 min read →