The Complete Production SOP: How to Deploy and Run Laravel Sanctum SPA Authentication & API Token Management in Autonomous AI Agents

---
name: "laravel-sanctum-spa-auth"
description: "Authenticate Single Page Applications (Next/Vue) and mobile apps with Laravel Sanctum."
metadata:
  author: "Laravel"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "setup laravel sanctum spa"
  - "csrf cookie sanctum nextjs"
  - "api token abilities sanctum"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

<?php

return [
    'paths' => ['api/*', 'sanctum/csrf-cookie', 'login', 'logout'],
    'allowed_methods' => ['*'],
    'allowed_origins' => [env('FRONTEND_URL', 'http://localhost:3000')],
    'allowed_origins_patterns' => [],
    'allowed_headers' => ['*'],
    'exposed_headers' => [],
    'max_age' => 0,
    'supports_credentials' => true,
];

<?php

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

// Stateful SPA authenticated user
Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return $request->user();
});

// Token issuance with explicit abilities for mobile/external consumers
Route::post('/tokens/create', function (Request $request) {
    $request->validate(['token_name' => 'required|string']);
    $token = $request->user()->createToken($request->token_name, ['orders:create', 'orders:read']);
    return response()->json(['token' => $token->plainTextToken]);
})->middleware('auth:sanctum');

// Route protected by granular ability
Route::middleware(['auth:sanctum', 'ability:orders:create'])->post('/orders', function (Request $request) {
    return response()->json(['status' => 'Order created']);
});