Laravel Sanctum is a lightweight authentication package for first-party SPAs, mobile applications, and simple token-based APIs. It can issue personal access tokens with abilities and authenticate requests through the Authorization header.

For a first-party SPA, Sanctum uses Laravel’s normal cookie-based session authentication rather than issuing a token to browser JavaScript. It first checks for a stateful authenticated session and otherwise checks for an API token, allowing one guard to support trusted browser clients and third-party token clients.