Laravel interview question · Most asked
Sanctum or Passport: which do you choose for API authentication?
Summary
Sanctum for first-party SPAs (cookie sessions with CSRF protection) and simple API tokens for mobile apps or integrations; Passport when you need a full OAuth2 server for third-party clients.
Longer Answer
Sanctum has two modes. For an SPA on the same top-level domain it uses Laravel's normal session cookie with CSRF protection, so no tokens are stored in JavaScript. For mobile apps and machine clients it issues personal access tokens (hashed in the database) with optional abilities (scopes) and expiry.
Passport implements OAuth2 (authorization code with PKCE, client credentials, refresh tokens). Choose it when other companies' applications need delegated access to your users' data, the "Sign in with your platform" case.
Many teams pick Passport when Sanctum would do; OAuth2 adds complexity you only need for third-party clients.
Key Points
- Sanctum: SPA cookie auth + simple tokens.
- Passport: full OAuth2 server.
- SPA cookie mode avoids tokens in localStorage.
More most-asked Laravel questions
- How do you validate requests in Laravel? Why use Form Requests?
- Gates or policies: how does authorization work in Laravel?
- What is mass assignment, and how do $fillable and $guarded protect against it?
- How do database transactions work in Laravel, and what pitfalls should you know?
- Which Artisan commands would you run when deploying Laravel to production, and why?
- What is the service container, and how does dependency injection work in Laravel?
- What is the N+1 query problem in Eloquent and how do you prevent it?
- How do queues work in Laravel?