要認(rèn)證Laravel API，推薦使用Laravel Sanctum，具體步驟如下：1. 通過Composer 安裝Sanctum 並發(fā)布配置文件和遷移；2. 在Kernel.php 中為api 中間件組添加EnsureFrontendRequestsAreStateful 中間件；3. 在User 模型中引入HasApiTokens trait；4. 創(chuàng)建登錄、獲取用戶和登出的API 路由，登錄時(shí)生成token 並返回；5. 使用auth:sanctum 中間件保護(hù)需要認(rèn)證的路由；6. 前端請(qǐng)求時(shí)在Authorization 頭中攜帶Bearer token 進(jìn)行認(rèn)證；此外可選配token 權(quán)限以實(shí)現(xiàn)細(xì)粒度控制，而若需構(gòu)建OAuth2 服務(wù)則應(yīng)選擇Passport，但對(duì)於大多數(shù)單頁(yè)或移動(dòng)應(yīng)用，Sanctum 更簡(jiǎn)單且足夠使用。

Authenticating an API in Laravel typically involves using Laravel Sanctum or Laravel Passport. For most modern Laravel APIs—especially single-page apps (SPAs) or mobile apps— Laravel Sanctum is the recommended and simpler approach. Here's how to set it up properly.

? 1. Install and Set Up Laravel Sanctum

First, install Sanctum via Composer:

 composer require laravel/sanctum

Publish the Sanctum configuration and migration files:

 php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

Run the migrations to create the personal access tokens table:

 php artisan migrate

? 2. Add Sanctum Middleware

In your app/Http/Kernel.php , make sure the EnsureFrontendRequestsAreStateful middleware is included in the api middleware group:

 'api' => [
    \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
    'throttle:api',
    \Illuminate\Routing\Middleware\SubstituteBindings::class,
],

? 3. Add HasApiTokens Trait to User Model

Ensure your User model (or any authenticatable model) uses the HasApiTokens trait:

 use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}

? 4. Create API Authentication Endpoints

You'll need basic login/logout and user endpoints. Here's an example in routes/api.php :

 use Illuminate\Http\Request;
use App\Models\User;

// Login
Route::post('/login', function (Request $request) {
    $credentials = $request->only('email', 'password');

    if (Auth::attempt($credentials)) {
        $user = Auth::user();
        $token = $user->createToken('api-token')->plainTextToken;

        return response()->json(['token' => $token]);
    }

    return response()->json(['error' => 'Unauthorized'], 401);
});

// Get authenticated user
Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
    return $request->user();
});

// Logout (invalidate token)
Route::middleware('auth:sanctum')->post('/logout', function (Request $request) {
    $request->user()->currentAccessToken()->delete();
    return response()->json(['message' => 'Logged out']);
});

? 5. Protecting Routes with auth:sanctum

Any route you want to protect should use the auth:sanctum middleware:

 Route::middleware(['auth:sanctum'])->group(function () {
    Route::get('/profile', [ProfileController::class, 'show']);
    Route::post('/data', [DataController::class, 'store']);
});

? 6. Calling the API from Frontend (Example)

After logging in and receiving the token, include it in the Authorization header:

 fetch('/api/user', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json',
  }
})

Note: Sanctum uses plain text tokens stored in the database. The Bearer token here is the plain-text value returned from createToken() .

Optional: Token Abilities (Scopes)

You can scope tokens for fine-grained access:

 $token = $user->createToken('api-token', ['read-posts', 'edit-posts'])->plainTextToken;

Then check abilities in middleware or controller:

 if ($request->user()->tokenCan('edit-posts')) {
    // Allow edit
}

When to Use Passport Instead?

• Use Laravel Passport if you're building an OAuth2 server (eg, third-party clients need to request access).
• For most internal APIs, SPAs, or mobile apps, Sanctum is simpler and sufficient .

Basically, Sanctum gives you a lightweight, token-based authentication system that's easy to set up and works great for typical Laravel API use cases. Just install, configure middleware, issue tokens on login, and protect routes.

以上是如何在Laravel中驗(yàn)證API？的詳細(xì)內(nèi)容。更多資訊請(qǐng)關(guān)注PHP中文網(wǎng)其他相關(guān)文章！