LaravelVueJs
Prefix a Laravel API with v1
routes/api.php is already under /api. Add v1 inside the file and keep Inertia pages out of it.
LaravelVueJs
Limit a Sanctum token with abilities
createToken can take an ability list. The ability middleware belongs on the API route, not on an Inertia page.
LaravelVueJs
Issue a Sanctum token without breaking the SPA
A first-party Vue SPA uses the session cookie. createToken is for a mobile client or another product.
LaravelVueJs
Set SESSION_DOMAIN for a Vue app
Leave SESSION_DOMAIN empty on one host. Set the parent domain only when Vue and Laravel are real subdomains.
LaravelVueJs
Sanctum or Passport for a Vue app
Sanctum is the cookie and the API token. Passport is the OAuth server for a third party that brings its own client id.
LaravelVueJs
Nuxt 4 in front of a Laravel API
Nuxt renders the public site. Laravel stays the API. The cookie rules stay in the Sanctum guide. This page is the Nuxt call.
LaravelVueJs
Laravel and Vue CORS errors
A same-origin Inertia app does not need CORS. A separate SPA does, and a 419 is a different failure from a blocked response.
LaravelVueJs
Authenticate a Vue SPA with Laravel Sanctum
Cookie sessions for a first-party Vue app, CSRF, stateful domains, and the token path that is only for a phone or a third party.
Newsletter
Get the best of Laravel & Vue, once a month.
One short email with new guides, release notes worth reading and hand-picked community links. No spam, unsubscribe any time.