Compare Laravel Sanctum and Laravel Passport, and when should you choose each one?

Short answer

Sanctum is a lightweight package for personal API Tokens and cookie authentication for SPA apps; Passport is a full OAuth2 server for larger projects needing OAuth2 permissions and identity sharing with third parties.

Explanation

Sanctum is the default, ideal choice for 95% of applications (mobile apps and React/Vue SPA APIs) because it is simple and lightweight. Passport provides a complete server supporting OAuth2 standards such as Authorization Code Grant and Client Credentials Grant. It is needed when building a platform that lets external companies access your users' data through standard OAuth.

Code example

// Use Sanctum to issue a token
$token = $user->createToken('mobile-app')->plainTextToken;

Common mistakes

• Installing the complex Passport package and its many tables for a simple mobile app that needs only ordinary token authentication.

Follow-up questions

• How do you configure CORS in config/cors.php and avoid common errors with SPA applications?

Sources

• Laravel docs — Laravel Sanctum