Airlock Laravel Package

Product Decisions This Supports

• Build vs. Buy: Buy – Sanctum eliminates the need to build a custom token-based authentication system for SPAs (Single-Page Applications) or lightweight APIs, saving development time and reducing technical debt.
• Roadmap Alignment: Accelerates development for projects requiring token-based auth (e.g., mobile apps, SPAs, or microservices) by leveraging Laravel’s ecosystem. Ideal for teams prioritizing rapid iteration over custom solutions.
• Feature Expansion: Enables seamless integration with Laravel’s existing auth system (e.g., users, guards, policies), allowing PMs to extend functionality (e.g., token expiration, scopes, or multi-guard support) without reinventing the wheel.
• Use Cases:
  • SPA Authentication: Lightweight alternative to Passport for simpler APIs (e.g., React/Vue frontends).
  • Mobile Apps: Secure token-based auth for iOS/Android apps consuming Laravel APIs.
  • Internal Tools: Quick auth setup for admin dashboards or CLI tools interacting with APIs.
  • Multi-Tenant Systems: Supports token isolation via guards (e.g., sanctum + api guards).

When to Consider This Package

Adopt Sanctum if:

• Your project uses Laravel and requires token-based authentication for SPAs, mobile apps, or simple APIs.
• You need minimal overhead (no OAuth2 complexity) but still want security features like token expiration, scopes, or CSRF protection.
• Your team prioritizes developer velocity over custom auth solutions (e.g., Passport for OAuth2).
• You’re building a proof-of-concept or MVP where auth is a core requirement but not the focus.

Look elsewhere if:

• You need OAuth2 (use Laravel Passport or Fortify).
• Your API requires high scalability (Sanctum is optimized for simplicity, not distributed systems).
• You’re using non-Laravel backends (e.g., Django, Node.js).
• You need advanced features like token revocation hooks, custom grant types, or social logins (consider Passport or third-party packages).

How to Pitch It (Stakeholders)

For Executives: "Sanctum is a lightweight, battle-tested solution for securing APIs and SPAs in Laravel, cutting months of dev time. It’s like Laravel’s built-in auth system for tokens—no OAuth2 bloat, just secure, scalable authentication. Perfect for our [SPA/mobile/API] roadmap, with MIT licensing and Laravel’s long-term support. Let’s use it to ship faster while keeping security robust."

For Engineering: *"Sanctum gives us token auth for SPAs/mobile with zero setup hassle. Key benefits:

• Integrates seamlessly with Laravel’s auth (users, guards, policies).
• Supports token expiration, scopes, and CSRF protection out of the box.
• Lightweight: No Passport’s complexity; ideal for simple APIs or internal tools.
• Future-proof: Actively maintained (Laravel 13+ support, PHP 8.5+).
• Extensible: Customize token logic via events or middleware.

Proposal: Use Sanctum for [X project] to avoid reinventing auth. We can add token revocation or multi-guard support later if needed. Estimated time savings: [Y] weeks."*

For Developers: *"Sanctum is the easiest way to add token auth to Laravel. Key perks:

• 10-minute setup: composer require laravel/sanctum, run migrations, done.
• SPA-friendly: Stateless tokens + CSRF cookies for web apps.
• Mobile-ready: Simple Bearer tokens for iOS/Android.
• No Passport bloat: No OAuth2 if you don’t need it.
• Laravel-native: Works with Eloquent, policies, and existing auth.

Example use case: Secure our [React/Vue] dashboard API without writing auth middleware from scratch."*