Sanctum is Laravel’s simpler option for first-party SPAs, mobile applications, and personal access tokens. It supports cookie-based SPA authentication and straightforward API tokens with abilities, without requiring an OAuth2 authorization-server workflow.

Passport is Laravel’s OAuth2 server package and supports the OAuth2 grant types and flows needed when third-party clients must obtain delegated access tokens through OAuth. Prefer Sanctum when its simpler model meets the need; choose Passport when the application genuinely requires OAuth2 features, such as standards-based third-party authorization or clients that expect OAuth.