# Laravel Fortify with Vue > The Vue starter kit already ships Fortify screens. Install Fortify when the front end is a separate SPA, or when those actions need a new field. - URL: https://laravel-vuejs.space/laravel-fortify-vue - Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine) - Published: 2026-10-10 - Topics: Laravel, VueJs You want login, registration and password reset for a Vue app without a second auth stack. Here is when Fortify is the right install, and what to edit instead when it isn’t. > **TL;DR** > > - The Vue starter kit already ships Fortify: edit `app/Actions/Fortify/*`, not a second login route. > - A separate SPA: install Fortify, set `views` to `false`, post to `/login` after `GET /sanctum/csrf-cookie`. > - Fortify on a SPA is the session cookie, not a bearer token. > - Turn features on and off in `config/fortify.php`. > > **What you'll learn** > > - Where the starter kit already uses Fortify > - How a separate Vue SPA posts to Fortify endpoints > - What to customize, and where > > **Who it's for:** Laravel + Vue developers adding or customizing auth > > **Applies to:** Laravel 13 · Fortify · Sanctum · Vue starter kit Search results for “Laravel Fortify Vue” still start with `composer require laravel/fortify` on top of Breeze. The current Vue starter kit already did that work. Login, registration, password reset, and email verification are Vue pages, and the actions that write the user live in `app/Actions/Fortify`. Installing Fortify a second time does not give you a better login form. Use this page in two cases. You are changing those actions. Or the browser is a separate SPA and Fortify should expose the auth endpoints without rendering views. The cookie, the CSRF call, and CORS are [Sanctum for a Vue SPA](https://laravel-vuejs.space/laravel-sanctum-vue-spa). Which front end you are building is [Inertia, a SPA, or Nuxt](https://laravel-vuejs.space/laravel-vue-in-2026). GitHub as the only login is [Socialite](https://laravel-vuejs.space/laravel-socialite-vue). ## Case 1: the starter kit Open `app/Actions/Fortify/CreateNewUser.php` when registration needs another column. The `create` method already validates name, email, and password. Add the column to that array and to the `User::create` call. Do the same kind of edit in `ResetUserPassword` when the reset rules change. The Vue pages are under `resources/js/pages/auth`. They post to Fortify. You do not register a second `POST /login`. The full route list, including two-factor routes this page does not copy, is in the [Fortify docs for Laravel 13](https://laravel.com/docs/13.x/fortify). ## Case 2: a separate SPA Fortify is the right install when Laravel is the API and Vue is another origin. The views stay off. The SPA renders the forms and posts to Fortify. ```bash composer require laravel/fortify php artisan fortify:install php artisan migrate ``` `config/fortify.php` ```diff - 'views' => true, + 'views' => false, ``` With views off, Fortify does not try to return a Blade login page. These are the POST endpoints a first SPA usually needs: - `/login` - `/register` - `/forgot-password` - `/reset-password` - `/email/verification-notification` > **See every route Fortify registered** > > ```bash > php artisan route:list --path=login > php artisan route:list --path=password > ``` > **Heads up: 419, 422, and no bearer tokens** > > Send them after `GET /sanctum/csrf-cookie`, with credentials, the same way the Sanctum guide posts `/login`. A 419 is still CSRF. A 422 is validation. Fortify’s register endpoint returns validation errors for a duplicate email. Show `errors.email` from that JSON. Do not store a bearer token from these responses. Fortify’s SPA story is the session cookie. `POST /logout` is also Fortify’s. Call it when the user signs out, then send them to the SPA’s login route. ## What you customize Features are flags in `config/fortify.php`, not extra packages. Registration, password reset, and email verification are already named there. Turn a feature off in that file rather than deleting a route by hand. > **Tip: one source of truth for password rules** > > Keep password rules in `CreateNewUser` and `ResetUserPassword`. A Vue page that reimplements the same rules will drift. The server is the check that runs. ## Where this stops Fortify does not authorize “may this user edit this post”. That is a [policy](https://laravel-vuejs.space/laravel-vue-policies) or a [permission](https://laravel-vuejs.space/laravel-vue-permissions). It also does not build the CRUD behind the login. That stays the [CRUD guide](https://laravel-vuejs.space/laravel-inertia-vue-crud). ## Recap - The Vue starter kit is already Fortify; customize `CreateNewUser` and `ResetUserPassword`. - Install Fortify yourself only for a separate SPA, with `views` off. - Post after the CSRF cookie, with credentials. 419 = CSRF, 422 = validation. - Authorization is a policy, not Fortify. ## FAQ **Q: Do I need to install Fortify on the Laravel Vue starter kit?** No. The kit already uses Fortify. Its actions are in `app/Actions/Fortify` and its pages in `resources/js/pages/auth`. **Q: How do I add a field to registration with Fortify?** Add the validation rule and the column to `CreateNewUser::create`, then add the input to the Vue register page. **Q: Why does my SPA get a 419 from Fortify /login?** The CSRF cookie is missing or the session domain is wrong. Call `GET /sanctum/csrf-cookie` first and send credentials. **Q: Does Fortify return an API token for my Vue SPA?** No. Fortify’s SPA flow uses the session cookie. Use Sanctum tokens only for mobile apps or scripts. ## Next steps - [Sanctum for a Vue SPA](https://laravel-vuejs.space/laravel-sanctum-vue-spa): the cookie and CSRF steps. - [Laravel and Vue CORS errors](https://laravel-vuejs.space/laravel-vue-cors) - [Breeze, Jetstream, and the Vue starter kit](https://laravel-vuejs.space/laravel-breeze-jetstream-vue) - [Laravel docs: Fortify](https://laravel.com/docs/13.x/fortify) ## Sources - [Laravel 13: Fortify](https://laravel.com/docs/13.x/fortify) - [Laravel 13: Sanctum, SPA authentication](https://laravel.com/docs/13.x/sanctum#spa-authentication) - [Laravel 13: Starter kits](https://laravel.com/docs/13.x/starter-kits)