Get your next remote job on LaraJobs.
Laravel Packages Security

Secure your REST API in 5 minutes with Laravel Sanctum

Benjamin Crozat
Published on Jan 16, 2024 0 comments Edit on GitHub
Secure your REST API in 5 minutes with Laravel Sanctum

Introduction to Laravel Sanctum and how it helps securing REST APIs

Laravel Sanctum is a package for Laravel that provides a simple way to secure your REST API. For instance, in case you want your users to be able to build services top of your application.

That being said, the official documentation is extensive and you probably don’t have that kind of time. So I hope my quick guide will serve you well.

Install Laravel Sanctum via Composer

The package now come installed by default in any new Laravel application.

If for some reasons you don’t have Laravel Sanctum in your project, install it using Composer:

composer require laravel/sanctum

Once done, publish Sanctum’s configuration and migration files:

php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

Finally, run your database migrations:

php artisan migrate

Issue API tokens to your users

You need to let your users generate tokens to consume your API.

Add the Laravel\Sanctum\HasApiTokens trait in your User model:

namespace App\Models;

use Laravel\Sanctum\HasApiTokens; // [tl! ++]

class User extends Authenticatable
    use HasApiTokens; // [tl! ++]

You can issue a token using the createToken method:

$token = $user->createToken('token-name')->plainTextToken;

Make sure to let the user know that the token is only shown once. If they lose it, they’ll have to generate a new one.

Protect your REST API routes with Sanctum’s auth guard

To secure your API routes, use the sanctum guard. This ensures that all incoming requests are authenticated:

    ->get('/api/user', function (Request $request) {
        return $request->user();

Manage your users’ API tokens

Managing tokens is crucial for security. To revoke them, use:

// Revoke all tokens.

// Revoke a specific token.
$user->tokens()->where('id', $tokenId)->delete();


Securing your REST API with Laravel Sanctum is an effective way to manage authentication and prevent misuses without overcomplicating everything.

There’s a lot more to Laravel Sanctum and I encourage you to go read the official documentation.

Wait, there's more!

Be the first to comment!

Get help or share something of value with other readers!

Great deals for enterprise developers
  • ZoneWatcher
    Get instant alerts on DNS changes across all major providers, before your customers notice.
    25% off for 12 months using the promo code CROZAT.
    Try ZoneWatcher for free
  • Quickly build highly customizable admin panels for Laravel projects.
    20% off on the pro version using the promo code CROZAT.
    Try Backpack for free
  • Summarize and talk to YouTube videos. Bypass ads, sponsors, chit-chat, and get to the point.
    Try Nobinge →
  • Monitor the health of your apps: downtimes, certificates, broken links, and more.
    20% off the first 3 months using the promo code CROZAT.
    Try Oh Dear for free
  • Keep the customers coming; monitor your Google rankings.
    30% off your first month using the promo code WELCOME30
    Try Wincher for free →
The latest community links
- / -