Laravel 8 REST API Authentication with Sanctum
Tags: laravel, restapi, php, webdev
Published: 2021-05-16 16:07:57

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gfzap5yn1tr0nd9husrg.png)

#Source Code
[Github](https://github.com/Remonhasan/product-api-laravel-sanctum-spa)

Laravel Sanctum, formerly known as Airlock, is a Laravel package created for the authentication of Single Page Applications (SPAs), mobile applications, and basic token-based APIs. It can be used to issue API Tokens to your users and authenticate Single Page Applications using Laravel's session.
we are going to create product api. For testing we will use the postman.

# Model and Migration
First, we have to create a product model,migration,controller as like:

`php artisan make:model Product -m`
`php artisan make:controller ProductController --api`

Create the fields as like: 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f9jedf1vtxl1frtuda49.png)

Migrate: Before migrate you should create the database in env file and connect to the MySql server or others you prefer.

`php artisan migrate`

# Route
Second, we have to create a resource route in api.php as like:

`Route::resource('products', ProductController::class);`

# Controller Functions

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zqck352t9zaliwii1vcg.png)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ndg1b2w6i9b9ikh1xl7y.png)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/opkxai77maanguq3ezrc.png)

#Postman Test

Create:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3j1q3vrs5tt0gvizv934.png)

Update:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l7y2hnl44ivdebya78tc.png)

Validation: 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u9mu2rczlwb06ob9cfqo.png)

Delete:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eaj7v8r6pq12e8igm1rg.png)

Search by Name:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4p9objvvua7gbsufy37m.png)

Get by ID:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/811tbj025ears4ubri4b.png)

#Sanctum Authentication and Access Token Generation

Install Sanctum:

`composer require laravel/sanctum`

Vendor Publish for access token migration:

`php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"`

Migrate:

`php artisan migrate`

#setup
Go to app, then kernel.php and add the given lines in api array section. also for query you can follow [laravel Sanctum Documentation] (https://laravel.com/docs/8.x/sanctum#introduction)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aq5gadrhj5tamt2a5vgw.png)

Add to User Model: Go to User.php and add the lines:

`use Laravel\Sanctum\HasApiTokens;`

`use HasFactory, Notifiable, HasApiTokens;`

Create a group route function which will include the protected routes:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/up7irnixn1cw7ed9i9ar.png)

#Create Controller

`php artisan make:controller AuthController`

#Register Function

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d6wrb7kkedky8vbtz8xk.png)

Postman Test:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xm4ggvyc77lzhojf0tq2.png)

Get Product access by token:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xa8mr7pn7ogf0u5qrant.png)

Now add logout: After logout the token will be deleted.

`public function logout(Request $request) {
        auth()->user()->tokens()->delete();

        return [
            'message' => 'Logged out'
        ];
    }` 

Create logout route:

`Route::post('/logout', [AuthController::class, 'logout']);`

Postman Test:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xijo7blp5okctsuhce1l.png)

# Login 

Create route for login as like:

`Route::post('/login', [AuthController::class, 'login']);`

Login Function:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r790gkxwqxlotwthwtq6.png)

Logged in:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uji72qg0fazrjxrxw7bp.png)

#All Public and Protected Route

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wwxxbmps4np1z0rbkdld.png)