Laravel 12 Sanctum API Authentication (Step by Step)

1️⃣ Sanctum Install

composer require laravel/sanctum

2️⃣ Config Publish

php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

3️⃣ Migration Run

For personal_access_tokens table

php artisan migrate

4️⃣ User Model Update

use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}

5️⃣ API Middleware

create api.php in routes folder

<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\Auth\ApiAuthController;

Route::post('/v1/register', [ApiAuthController::class, 'register']);
Route::post('/v1/login', [ApiAuthController::class, 'login']);

Route::middleware('auth:sanctum')->group(function () {
    Route::post('/v1/logout', [ApiAuthController::class, 'logout']);
    Route::get('/v1/user-info', [ApiAuthController::class, 'info']);
});

6️⃣ API Controller

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\Customer;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;

class ApiAuthController extends Controller
{
    public function register(Request $request) {}

    public function login(Request $request)
    {
        $request->validate([
            'phone' => 'required',
            'password' => 'required',
        ]);

        $user = Customer::where('email', $request->email)
            ->orWhere('code', $request->email)
            ->first();

        if (! $user || ! Hash::check($request->password, $user->password)) {
            return response()->json(['message' => 'Invalid credentials'], 401);
        }

        $token = $user->createToken('api_token')->plainTextToken;

        return response()->json([
            'user' => $user,
            'token' => $token
        ]);
    }

    public function logout(Request $request)
    {
        $request->user()->tokens()->delete();
        return response()->json(['message' => 'Logged out']);
    }

    public function info()
    {
        return $request->user();
    }
}