---
name: "laravel-sanctum-spa-auth"
description: "Authenticate Single Page Applications (Next/Vue) and mobile apps with Laravel Sanctum."
metadata:
  author: "Laravel"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "setup laravel sanctum spa"
  - "csrf cookie sanctum nextjs"
  - "api token abilities sanctum"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Laravel Sanctum SPA Authentication & API Token Management

Configures Laravel Sanctum: cookie-based SPA session authentication (CSRF protection, stateful domains), issuing mobile API tokens with abilities (createToken), token revocation, and protecting routes with auth:sanctum.

## When to Invoke
Invoke this skill whenever you need to:
- setup laravel sanctum spa
- csrf cookie sanctum nextjs
- api token abilities sanctum

## Execution SOP & Rules
1. Add SANCTUM_STATEFUL_DOMAINS=localhost:3000,app.example.com to .env.
2. Ensure EnsureFrontendRequestsAreStateful middleware is active in api middleware stack.
3. Frontend workflow: axios.get('/sanctum/csrf-cookie') before axios.post('/login', credentials).
4. Protect API routes: Route::middleware('auth:sanctum')->get('/user', fn(Request $request) => $request->user());.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.