{"id":346,"date":"2025-08-27T20:06:26","date_gmt":"2025-08-27T20:06:26","guid":{"rendered":"https:\/\/1v0.net\/blog\/?p=346"},"modified":"2025-08-27T20:06:27","modified_gmt":"2025-08-27T20:06:27","slug":"how-to-build-a-multi-auth-api-with-laravel-sanctum","status":"publish","type":"post","link":"https:\/\/1v0.net\/blog\/how-to-build-a-multi-auth-api-with-laravel-sanctum\/","title":{"rendered":"How to Build a Multi-Auth API with Laravel & Sanctum"},"content":{"rendered":"\n

How to Build a Multi-Auth API with Laravel & Sanctum<\/strong><\/h2>\n\n\n\n

Sometimes an app needs different authentication flows for different user types \u2014 for example, customers<\/em> and admins<\/em>. With Laravel Sanctum, you can build a multi-auth API<\/strong> by defining multiple guards and issuing tokens with different abilities. In this guide, you\u2019ll configure Sanctum for multi-auth, create endpoints for both user roles, and secure them appropriately.<\/p>\n\n\n\n

<\/div>\n\n\n\n

1 – Configure Guards in auth.php<\/strong><\/h2>\n\n\n\n

By default, Laravel has web<\/code> and api<\/code> guards. You can define extra guards for custom roles like admin<\/code>.<\/p>\n\n\n

\/\/ config\/auth.php (snippet)<\/span>\n'guards'<\/span> => [\n    'web'<\/span> => [\n        'driver'<\/span> => 'session'<\/span>,\n        'provider'<\/span> => 'users'<\/span>,\n    ],\n\n    'api'<\/span> => [\n        'driver'<\/span> => 'sanctum'<\/span>,\n        'provider'<\/span> => 'users'<\/span>,\n    ],\n\n    'admin'<\/span> => [\n        'driver'<\/span> => 'sanctum'<\/span>,\n        'provider'<\/span> => 'admins'<\/span>,\n    ],\n],\n\n'providers'<\/span> => [\n    'users'<\/span> => [\n        'driver'<\/span> => 'eloquent'<\/span>,\n        'model'<\/span> => App\\Models\\User::class,\n    ],\n    'admins'<\/span> => [\n        'driver'<\/span> => 'eloquent'<\/span>,\n        'model'<\/span> => App\\Models\\Admin::class,\n    ],\n],<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
This configuration adds an admin<\/code> guard that uses Sanctum for authentication. We\u2019ll create an Admin<\/code> model to support it. Each guard maps to its own provider.<\/p>\n\n\n\n
<\/div>\n\n\n\n
2 – Create Admin Model and Migration<\/strong><\/h2>\n\n\n\n
Add a separate admins<\/code> table and model. This keeps admin accounts separate from user accounts.<\/p>\n\n\n
\/\/ database\/migrations\/2025_08_27_000000_create_admins_table.php<\/span>\nuse<\/span> Illuminate<\/span>\\Database<\/span>\\Migrations<\/span>\\Migration<\/span>;\nuse<\/span> Illuminate<\/span>\\Database<\/span>\\Schema<\/span>\\Blueprint<\/span>;\nuse<\/span> Illuminate<\/span>\\Support<\/span>\\Facades<\/span>\\Schema<\/span>;\n\nreturn<\/span> new<\/span> class<\/span> extends<\/span> Migration<\/span> <\/span>{\n    public<\/span> function<\/span> up<\/span>()<\/span>: void<\/span> <\/span>{\n        Schema::create('admins'<\/span>, function<\/span> (Blueprint $table)<\/span> <\/span>{\n            $table->id();\n            $table->string('name'<\/span>);\n            $table->string('email'<\/span>)->unique();\n            $table->string('password'<\/span>);\n            $table->timestamps();\n        });\n    }\n    public<\/span> function<\/span> down<\/span>()<\/span>: void<\/span> <\/span>{\n        Schema::dropIfExists('admins'<\/span>);\n    }\n};<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
This migration creates a new admins<\/code> table with unique emails. In practice, you might also add role<\/code> or permissions<\/code> fields for fine-grained access control.<\/p>\n\n\n
\/\/ app\/Models\/Admin.php<\/span>\nnamespace<\/span> App<\/span>\\Models<\/span>;\n\nuse<\/span> Illuminate<\/span>\\Foundation<\/span>\\Auth<\/span>\\User<\/span> as<\/span> Authenticatable<\/span>;\nuse<\/span> Laravel<\/span>\\Sanctum<\/span>\\HasApiTokens<\/span>;\n\nclass<\/span> Admin<\/span> extends<\/span> Authenticatable<\/span>\n<\/span>{\n    use<\/span> HasApiTokens<\/span>;\n\n    protected<\/span> $fillable = ['name'<\/span>,'email'<\/span>,'password'<\/span>];\n    protected<\/span> $hidden = ['password'<\/span>];\n}<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
The Admin<\/code> model uses HasApiTokens<\/code> to generate and validate Sanctum tokens, just like the User model.<\/p>\n\n\n\n
<\/div>\n\n\n\n
3 – Authentication Endpoints<\/strong><\/h2>\n\n\n\n
Create controllers for login\/logout flows for both users and admins. Each will issue tokens tied to the correct guard.<\/p>\n\n\n
\/\/ routes\/api.php<\/span>\nuse<\/span> App<\/span>\\Http<\/span>\\Controllers<\/span>\\UserAuthController<\/span>;\nuse<\/span> App<\/span>\\Http<\/span>\\Controllers<\/span>\\AdminAuthController<\/span>;\n\nRoute::post('\/user\/login'<\/span>, [UserAuthController::class, 'login'<\/span>]);\nRoute::post('\/admin\/login'<\/span>, [AdminAuthController::class, 'login'<\/span>]);\n\nRoute::middleware('auth:sanctum'<\/span>)->group(function<\/span> ()<\/span> <\/span>{\n    Route::post('\/user\/logout'<\/span>, [UserAuthController::class, 'logout'<\/span>]);\n    Route::post('\/admin\/logout'<\/span>, [AdminAuthController::class, 'logout'<\/span>]);\n});<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
This provides separate login endpoints for users and admins. Both use Sanctum, but tokens are tied to their respective models.<\/p>\n\n\n
\/\/ app\/Http\/Controllers\/AdminAuthController.php<\/span>\nnamespace<\/span> App<\/span>\\Http<\/span>\\Controllers<\/span>;\n\nuse<\/span> App<\/span>\\Models<\/span>\\Admin<\/span>;\nuse<\/span> Illuminate<\/span>\\Http<\/span>\\Request<\/span>;\nuse<\/span> Illuminate<\/span>\\Support<\/span>\\Facades<\/span>\\Hash<\/span>;\n\nclass<\/span> AdminAuthController<\/span> extends<\/span> Controller<\/span>\n<\/span>{\n    public<\/span> function<\/span> login<\/span>(Request $request)<\/span>\n    <\/span>{\n        $request->validate([\n            'email'<\/span> => 'required|email'<\/span>,\n            'password'<\/span> => 'required'<\/span>\n        ]);\n\n        $admin = Admin::where('email'<\/span>,$request->email)->first();\n\n        if<\/span> (!$admin || !Hash::check($request->password, $admin->password)) {\n            return<\/span> response()->json(['message'<\/span> => 'Invalid credentials'<\/span>], 401<\/span>);\n        }\n\n        $token = $admin->createToken('admin-token'<\/span>,['admin'<\/span>])->plainTextToken;\n\n        return<\/span> response()->json(['token'<\/span> => $token]);\n    }\n\n    public<\/span> function<\/span> logout<\/span>(Request $request)<\/span>\n    <\/span>{\n        $request->user()->currentAccessToken()->delete();\n        return<\/span> response()->json(['message'<\/span> => 'Logged out'<\/span>]);\n    }\n}<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
The admin login issues a token with ability admin<\/code>. This lets you enforce role-based access later by checking abilities on tokens. Logout deletes the current token.<\/p>\n\n\n\n
<\/div>\n\n\n\n
4 – Securing Routes by Role<\/strong><\/h2>\n\n\n\n
You can restrict routes by checking Sanctum token abilities, ensuring only admins can access certain endpoints.<\/p>\n\n\n
\/\/ routes\/api.php (snippet)<\/span>\nRoute::middleware(['auth:sanctum'<\/span>,'ability:admin'<\/span>])->group(function<\/span> ()<\/span> <\/span>{\n    Route::get('\/admin\/dashboard'<\/span>, function<\/span> ()<\/span> <\/span>{\n        return<\/span> ['message'<\/span> => 'Welcome, Admin!'<\/span>];\n    });\n});<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Here, only tokens created with the admin<\/code> ability can access \/admin\/dashboard<\/code>. Normal user tokens will get a 403 Forbidden response.<\/p>\n\n\n\n
<\/div>\n\n\n\n
5 – UI: Simple API Test Page<\/strong><\/h2>\n\n\n\n
Here\u2019s a minimal UI to test admin vs user endpoints with tokens.<\/p>\n\n\n
<!-- resources\/views\/api\/multi-auth-test.blade.php --><\/span>\n@extends('layouts.app')\n\n@section('content')\n<div<\/span> class<\/span>=\"container\"<\/span>><\/span>\n  <h1<\/span>><\/span>Multi-Auth API Tester<\/h1<\/span>><\/span>\n\n  <input<\/span> type<\/span>=\"text\"<\/span> id<\/span>=\"token\"<\/span> class<\/span>=\"form-control mb-3\"<\/span> placeholder<\/span>=\"Paste Bearer Token\"<\/span>><\/span>\n  <button<\/span> class<\/span>=\"btn btn-theme mb-3\"<\/span> onclick<\/span>=\"testUser()\"<\/span>><\/span>Test User Endpoint<\/button<\/span>><\/span>\n  <button<\/span> class<\/span>=\"btn btn-danger mb-3\"<\/span> onclick<\/span>=\"testAdmin()\"<\/span>><\/span>Test Admin Endpoint<\/button<\/span>><\/span>\n\n  <pre<\/span> id<\/span>=\"result\"<\/span>><\/span><\/pre<\/span>><\/span>\n<\/div<\/span>><\/span>\n\n<script<\/span> src<\/span>=\"https:\/\/cdn.jsdelivr.net\/npm\/axios\/dist\/axios.min.js\"<\/span>><\/span><\/script<\/span>><\/span>\n<script<\/span>><\/span>\nfunction<\/span> testUser<\/span>(<\/span>) <\/span>{\n  const<\/span> token = document<\/span>.getElementById('token'<\/span>).value;\n  axios.get('\/api\/posts'<\/span>, { headers<\/span>: { Authorization<\/span>: `Bearer ${token}<\/span>`<\/span> } })\n    .then(r<\/span> =><\/span> document<\/span>.getElementById('result'<\/span>).textContent = JSON<\/span>.stringify(r.data,null<\/span>,2<\/span>))\n    .catch(e<\/span> =><\/span> document<\/span>.getElementById('result'<\/span>).textContent = e);\n}\nfunction<\/span> testAdmin<\/span>(<\/span>) <\/span>{\n  const<\/span> token = document<\/span>.getElementById('token'<\/span>).value;\n  axios.get('\/api\/admin\/dashboard'<\/span>, { headers<\/span>: { Authorization<\/span>: `Bearer ${token}<\/span>`<\/span> } })\n    .then(r<\/span> =><\/span> document<\/span>.getElementById('result'<\/span>).textContent = JSON<\/span>.stringify(r.data,null<\/span>,2<\/span>))\n    .catch(e<\/span> =><\/span> document<\/span>.getElementById('result'<\/span>).textContent = e);\n}\n<\/span><\/script<\/span>><\/span>\n@endsection<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
This page lets you paste a token and call either a user or an admin endpoint. With the wrong token type, you\u2019ll see an error \u2014 demonstrating multi-auth in action.<\/p>\n\n\n\n
<\/div>\n\n\n\n
Wrapping Up<\/h2>\n\n\n\n
By configuring multiple guards and issuing tokens with Sanctum, you can support different authentication flows for multiple user types. You built an Admin<\/code> model, set up endpoints for login\/logout, secured routes by token abilities, and tested the flow with a simple UI. This approach gives you flexibility while keeping authentication clean and secure.<\/p>\n\n\n\n
<\/div>\n\n\n\n
What\u2019s Next<\/h2>\n\n\n\n