Sanctum Laravel Package

Product Decisions This Supports

• Build vs. Buy: Buy – Sanctum eliminates the need to build a custom authentication system for SPAs or APIs, saving development time and reducing technical debt. It’s a lightweight, battle-tested solution maintained by Laravel’s core team.
• Roadmap Alignment: Enables rapid iteration for:
  • Headless CMS/API-driven apps (e.g., Next.js, React, Vue) where token-based auth is critical.
  • Multi-guard authentication (e.g., supporting both Sanctum for APIs and Laravel’s session auth for web).
  • Stateful API sessions (e.g., tracking user activity via last_used_at or CSRF protection).
• Feature Prioritization:
  • Phase 1: Integrate Sanctum for SPA/API auth to replace ad-hoc JWT or session systems.
  • Phase 2: Leverage token expiration/pruning to reduce database bloat (via expires_at).
  • Phase 3: Extend with custom token queries or scopes for granular permissions.
• Use Cases:
  • Internal tools with embedded SPAs (e.g., admin dashboards).
  • Mobile apps using Laravel as a backend (via token-based auth).
  • Microservices needing lightweight, stateless auth between services.

When to Consider This Package

Adopt Sanctum if:

• Your app uses Laravel and needs SPA/API authentication with minimal overhead.
• You prioritize simplicity over customization (e.g., no need for OAuth2/Passport complexity).
• Your frontend is JavaScript-based (React, Vue, Next.js) and requires CSRF protection or stateful sessions.
• You want built-in token expiration, pruning, and database optimizations (e.g., indexed tokens).

Look elsewhere if:

• You need OAuth2 or social logins (use Laravel Passport or a dedicated OAuth package).
• Your auth requirements are highly custom (e.g., multi-factor auth, complex scopes).
• You’re not using Laravel (Sanctum is Laravel-specific).
• You require enterprise-grade audit logs or revocation hooks (may need to extend Sanctum or use a dedicated auth service).

How to Pitch It (Stakeholders)

For Executives: "Sanctum is a lightweight, Laravel-native solution to replace our custom JWT or session-based auth for SPAs/APIs. It cuts development time by 60% (no need to build token validation, CSRF protection, or session management from scratch) while adding security features like token expiration and pruning. Used by [X] projects, it’s maintained by Laravel’s core team, ensuring long-term stability. This aligns with our roadmap to modernize our backend for [Y] use cases, reducing tech debt and enabling faster feature delivery."

For Engineering: *"Sanctum gives us a drop-in auth system for SPAs/APIs with:

• Token-based auth (no sessions, stateless by default).
• CSRF protection for stateful APIs (e.g., Next.js).
• Performance optimizations (indexed tokens, pruning).
• Laravel 13/PHP 8.5 support and active maintenance. It’s 3x lighter than Passport** for simple use cases and integrates seamlessly with Laravel’s ecosystem. We can extend it later for custom scopes or guards if needed. Migration risk is low—it’s a one-command install (composer require laravel/sanctum)."*

For Developers: *"Sanctum replaces our hacky auth system with:

• HasApiTokens trait for easy token management in models.
• Pre-built routes for login/logout (no manual API endpoint work).
• Token expiration and automatic pruning (no manual cleanup).
• Stateful sessions for SPAs (CSRF tokens, last_used_at tracking). Example:

// Generate a token for a user
$token = $user->createToken('api-token')->plainTextToken;

// Use in SPA
fetch('/api/data', {
  headers: { 'Authorization': `Bearer ${token}` }
});

Pros: No Passport bloat, works out-of-the-box. Cons: Limited to Laravel/PHP."*