Laravel Sanctum integration

Note

The sanctum auth guard can’t be used with user impersonation because user impersonation supports stateful guards only.

Laravel Sanctum works with Tenancy out of the box, with the exception of the sanctum.csrf-cookie route. You can make some small changes to make the route work.

Making the csrf-cookie route work in the tenant app

To make the sanctum.csrf-cookie route work in the tenant app, do the following:

1. Add 'routes' => false to the sanctum.php config
2. Move the Sanctum migration (for personal_access_tokens table) to database/migrations/tenant (the migration is published during install:api, it should be in database/migrations - if you don’t have that migration, you can publish it using php artisan vendor:publish --tag=sanctum-migrations)
3. Add the following code to routes/tenant.php to override the original sanctum.csrf-cookie route:

Route::group(['prefix' => config('sanctum.prefix', 'sanctum')], static function () {
    Route::get('/csrf-cookie', [CsrfCookieController::class, 'show'])
        ->middleware([
            'web',
            InitializeTenancyByDomain::class // Use tenancy initialization middleware of your choice
        ])->name('sanctum.csrf-cookie');
});

Making the csrf-cookie route work both in the central and the tenant app

To use the sanctum.csrf-cookie route in both the central and the tenant apps:

1. Follow the steps in the previous section to make the csrf-cookie route work in the tenant app
2. Include the personal_access_tokens migration in database/migrations too (either publish it again, or copy it from database/migrations/tenant)
3. Remove 'routes' => false from the sanctum.php config
4. Add the 'universal' middleware to the sanctum.csrf-cookie route in your routes/tenant.php