Sanctum Laravel Package

Product Decisions This Supports

• Build vs. Buy: Buy – Sanctum eliminates the need to build a custom lightweight authentication system for SPAs (Single-Page Applications) or simple APIs, reducing development time and maintenance overhead.
• Roadmap Alignment: Enables rapid iteration for projects requiring token-based authentication (e.g., mobile apps, SPAs, or internal tools) without bloating the stack with heavier solutions like Passport.
• Feature Prioritization:
  • Stateful API Support: Ideal for projects needing seamless integration with frontend frameworks (React, Vue, Next.js) via cookies.
  • Stateless API Support: Lightweight alternative to Passport for APIs requiring token-based auth without OAuth2 complexity.
  • Multi-Guard Support: Useful for projects with mixed auth requirements (e.g., web + API).
  • Token Expiration & Tracking: Supports compliance and security requirements (e.g., GDPR, session management).
• Use Cases:
  • Internal dashboards or admin panels.
  • Mobile apps with Laravel backend APIs.
  • Projects where Passport’s complexity is unnecessary.
  • Prototyping or MVP phases where auth is needed quickly.

When to Consider This Package

Adopt Sanctum if:

• Your project requires lightweight token-based authentication (no OAuth2 complexity).
• You’re building a SPA, mobile app, or simple API with Laravel.
• You need cookie-based auth for stateful APIs (e.g., Next.js, Vue, React).
• You’re using Laravel 10+ and want minimal setup (5-minute installation).
• Your team lacks OAuth2 expertise but needs secure token validation.
• You prioritize performance (Sanctum is optimized for speed with indexed tokens).

Look elsewhere if:

• You need OAuth2 (use Laravel Passport or Sanctum + OAuth2 extensions).
• Your API requires third-party integrations (e.g., social logins, SSO).
• You’re building a highly scalable microservice architecture with complex auth flows.
• Your project demands enterprise-grade audit logs (Sanctum’s logging is basic).
• You’re using non-Laravel backends (Sanctum is Laravel-specific).

How to Pitch It (Stakeholders)

For Executives: "Sanctum is a lightweight, battle-tested solution to add secure authentication to our Laravel APIs or SPAs in hours—not weeks. It’s like Laravel’s built-in session auth, but for APIs and modern frontends. With zero OAuth2 overhead, we can ship features faster while maintaining security. It’s used by thousands of projects, including Laravel’s own ecosystem, and integrates seamlessly with React, Vue, and mobile apps. The cost? Zero—it’s open-source and MIT-licensed."

For Engineering Teams: *"Sanctum gives us a drop-in replacement for custom auth logic, with built-in support for:

• Token-based API auth (stateless or stateful via cookies).
• Multi-guard support (e.g., web + API auth in one app).
• Token expiration & revocation (critical for compliance).
• Performance optimizations (indexed tokens, lazy loading).

It’s 5x faster to implement than Passport for simple use cases and plays nicely with Laravel’s ecosystem. The tradeoff? No OAuth2, but that’s a feature, not a bug, for our current needs. Let’s use it for [Project X] to avoid reinventing the wheel."*

For Developers: *"Sanctum handles the heavy lifting for API token auth with minimal boilerplate:

// Generate a token
$token = $user->createToken('api-token')->plainTextToken;

// Use it in your SPA
fetch('/api/data', {
  headers: { 'Authorization': `Bearer ${token}` }
});

• No Passport bloat: No OAuth2 servers, no complex migrations.
• SPA-friendly: Built-in CSRF protection and cookie-based auth.
• Extensible: Hook into token creation, revocation, or scopes easily.
• Laravel-native: Works with Eloquent, queues, and caching out of the box.

Use it for any project where you’d otherwise write a custom AuthServiceProvider or reach for Passport unnecessarily."*