# Limit a Sanctum token with abilities

> createToken can take an ability list. The ability middleware belongs on the API route, not on an Inertia page.

- URL: https://laravel-vuejs.space/sanctum-token-abilities-vue
- Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine)
- Published: 2026-10-11
- Topics: Laravel, VueJs, Sanctum

People searching “Sanctum token abilities” put `abilities:posts:read` on a browser route and then every Inertia page returns 403. Abilities exist on a token. A session does not have them. The [Sanctum guide](https://laravel-vuejs.space/laravel-sanctum-vue-spa) is the cookie. This page is the token.

> **TL;DR**
>
> -   createToken can take an ability list.
> -   The ability middleware belongs on the API route, not on an Inertia page.
> -   Do not call it from an Inertia controller and hide the button based on it.
> -   Do not treat abilities as a substitute for a [policy](https://laravel-vuejs.space/laravel-vue-policies).
>
> **Who it's for:** Laravel + Vue developers
>
> **Applies to:** Laravel 13 · Vue 3 · Sanctum

## The fix

```php
$plain = $request->user()->createToken('phone', ['posts:read'])->plainTextToken;
```

```php
Route::get('/posts', [Api\PostController::class, 'index'])
    ->middleware(['auth:sanctum', 'abilities:posts:read']);
```

That route lives in `routes/api.php`. The Vue starter kit’s pages stay on `routes/web.php` with `auth`.

In a controller that must be picky inside an action, `$request->user()->tokenCan('posts:read')` checks the current token. It is false for a session guard. Do not call it from an Inertia controller and hide the button based on it.

## What to avoid

> **Gotcha**
>
> Do not treat abilities as a substitute for a [policy](https://laravel-vuejs.space/laravel-vue-policies). An ability is what that token may do. A policy is what that user may do to a row.

## FAQ

**Q: How do I limit a Sanctum token with abilities?**

createToken can take an ability list. The ability middleware belongs on the API route, not on an Inertia page.

**Q: What goes wrong with Sanctum token abilities?**

Many developers put `abilities:posts:read` on a browser route and then every Inertia page returns 403. Do not call it from an Inertia controller and hide the button based on it.