{
  "id": 19776871,
  "title": "Laravel 13 REST API Authentication with Sanctum: Step-by-Step Tutorial",
  "url": "https://urgent.news/2026/11/13/laravel-13-rest-api-authentication-with-sanctum-step-by-step-tutorial",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-13T08:08:59.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/muhammadyasiramin/laravel-13-rest-api-authentication-with-sanctum-step-by-step-tutorial-28b9"
  },
  "original_language": "en",
  "account": "To create a REST API with token authentication in Laravel 13, first install Sanctum using the php artisan install:api command. This command publishes the API route file, creates the personal_access_tokens migration, and prepares the app for token authentication. Next, add the HasApiTokens trait to your User model to enable token creation and ownership.\n\nOn the login route, validate the user's credentials and password hash. If the credentials are valid, call the createToken() method on the authenticated User instance to generate a token with a specified device name. This method returns a plain-text token that can be returned to the client. Sanctum stores the token as a SHA-256 hash, so the plain-text version is only available once during token creation.\n\nFor token logout, simply delete the user's current access token. This clears the token from the user's session, ensuring that the user cannot access protected routes with the expired token.\n\nTo protect API routes, use the auth:sanctum middleware within the routes/api.php file. This middleware restricts access to only those requests that present a valid Sanctum token in the Bearer header. By attaching the Sanctum guard to the middleware, you ensure that only authenticated requests with a valid token can access the protected routes.\n\nToken abilities allow for fine-grained access control. When creating a token, you can pass an array of abilities as the second argument to the createToken() method. These abilities act like scopes, restricting access to specific routes or actions based on the token's capabilities. To check if a token has a particular ability, use the tokenCan() method on the user instance or attach a route middleware that verifies the token's ability. This provides an additional layer of security and flexibility in managing user permissions within the API.",
  "summary": "To build a REST API with token authentication in Laravel 13, install Sanctum with php artisan install:api , add the HasApiTokens trait to your User model, issue tokens with createToken() , and protect routes with the auth:sanctum middleware. Clients then send the token as a Bearer header. This guide builds a small login, profile and logout API and shows how to scope tokens with abilities. What do…",
  "key_points": [],
  "editors_take": "Implementing Sanctum within Laravel 13 streamlines the development of secure REST APIs by providing developers with built-in tools for token management, fine-grained access control, and automated route protection.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}