Weave Code
Filament Sanctum Laravel Package
devtical/filament-sanctum
Manage Laravel Sanctum API tokens directly from your Filament panel. Create, list, and revoke personal access tokens, define custom abilities and expiration presets, restrict access with gates, and display the page in the sidebar or user menu.
Filament Sanctum is a Filament plugin that lets you manage Laravel Sanctum personal access tokens directly from your admin panel—no custom CRUD screens required. Users can create, view, and revoke API tokens through a clean interface, with a one-time display of the generated token for secure copying.
Install the package alongside laravel/sanctum, add the HasApiTokens trait to your model, and register SanctumPlugin::make() in your panel provider to get started.
- Create and revoke personal access tokens from the panel
- Configurable abilities with customizable labels and column layout
- Optional token expiration with default durations and presets
- Choose user menu or sidebar navigation placement
- Gate-based authorization to restrict page access
Frequently asked questions about Filament Sanctum
- How do I install devtical/filament-sanctum in Laravel?
- Install it with composer require devtical/filament-sanctum laravel/sanctum. If Sanctum is not already set up, publish its service provider, run migrations, and add the HasApiTokens trait to your User model. Then register Devtical\Sanctum\SanctumPlugin::make() in your Filament panel provider. Optionally publish the package config and translations with the documented vendor:publish tags.
- Do I need Laravel Sanctum installed before using filament-sanctum?
- Yes. The package ships no migrations of its own and expects Sanctum's personal_access_tokens table to exist. Install and migrate Sanctum first, add HasApiTokens to your user model, then register the Filament plugin.
- Does filament-sanctum support Filament 4 and Laravel 11?
- Use the v1.0.0 line for Filament 3 or Filament 4 panels; pre-1.0 pins will not cover a Filament 4 panel. The documented stack fit is Laravel 10/11+ with Filament 4, with Filament 3 supported by the same v1.0.0 line. Pin the exact package version and record the Filament and Sanctum versions you test.
- How do I restrict who can manage Sanctum tokens in Filament?
- Enable the authorization block in config/filament-sanctum.php, set gate to your gate name, and define that gate in a service provider. For example, Gate::define('manage-api-tokens', fn (User $user) => $user->isAdmin()) limits the page to admins. The plugin renders the management UI but does not decide token-to-user scoping, so you must also enforce panel RBAC and any per-tenant visibility rules. Treat a misconfigured gate as a security incident because it can expose every user's tokens to any panel user.
- Can I move the Sanctum token page from the user menu to the sidebar?
- Yes. In config/filament-sanctum.php set navigation.sidebar_menu.enabled to true and navigation.user_menu.enabled to false. That moves the Sanctum page into sidebar navigation instead of the user menu.
- How do I customize token abilities and expiration presets?
- Edit the abilities block in config/filament-sanctum.php. Set list to your ability keys and labels, adjust columns, enable or disable expiration, and set default_expiration_days plus expiration_presets such as 7, 30, 60, and 90 days.
- Will my existing Sanctum personal access tokens show up in Filament?
- Yes. The plugin reads Sanctum's existing personal_access_tokens table, so tokens issued before installation appear immediately and become revocable in the panel. That is usually desirable, but make it a deliberate launch decision rather than a discovery.
- Is filament-sanctum compatible with Filament tenancy or multi-tenant apps?
- Filament tenancy support is not documented in the README, so validate it in staging before relying on it. The package is a thin resource over Sanctum's table, meaning tenant-aware query scoping and hasAccess() checks may need your own policy or resource customization. If token listings must be per-tenant, confirm that the resource filters by tenant and that gate checks are tenant-aware.
- Does filament-sanctum replace Sanctum API authentication or middleware?
- No. It is an admin UI layer for creating, listing, and revoking Sanctum tokens; API authentication still runs through Sanctum's existing middleware and guard. If the Filament page fails, existing APIs keep working and only token management in the panel goes dark.
- Is devtical/filament-sanctum maintained, and what are the alternatives?
- The package has a small adoption signal: 54 stars, zero dependents, and a single maintainer, though it is MIT licensed with a small code surface. The practical contingency is a fork or in-house absorption estimated at 1-2 dev days, not a rewrite. Alternatives are building a custom Filament resource for token management, which may take 10-20 dev hours, or keeping token issuance outside the panel.
Weaver
How can I help you explore Laravel packages today?