Intermediate LevelLaravel
When should you use Laravel Passport instead of Sanctum for OAuth2?
❓ Interview Prompt: Compare Laravel Passport (full OAuth2 server, authorization codes, client credentials) vs Laravel Sanctum (lightweight tokens/cookies).
1. Laravel Sanctum:
Best for internal SPAs, mobile apps, and lightweight token authentication. Simple setup without OAuth2 complexity.
2. Laravel Passport:
A full OAuth2 Server implementation based on League OAuth2 Server. Use Passport when third-party developers require standard OAuth2 authorization codes, client credentials, or refresh token grant types!
Code Implementation Example
php
<?php
// Passport issuing Client Credentials Grant Token
use IlluminateSupportFacadesHttp;
$response = Http::asForm()->post('https://auth.example.com/oauth/token', [
'grant_type' => 'client_credentials',
'client_id' => 'client-id-uuid',
'client_secret' => 'client-secret-key',
'scope' => 'orders:read',
]);💡Requesting OAuth2 bearer token via Passport Client Credentials grant.
🎯 Interview Key Takeaway
Use Sanctum for internal APIs and SPAs; use Passport when third-party developers require a full OAuth2 server implementation.
#Passport#OAuth2#Sanctum#Authentication#Intermediate
Back to all Laravel Questions→