laravel-auth
Implement authentication with Sanctum, Passport, Socialite, Fortify, policies, and gates. Use when setting up user authentication, API tokens, social login, or authorization.
When & Why to Use This Skill
This Claude skill streamlines the implementation of robust authentication and authorization systems in Laravel applications. It provides expert guidance and code snippets for integrating Laravel Sanctum for API tokens, Passport for OAuth2, Socialite for social logins, and Fortify for backend logic, while ensuring secure access control through policies and gates. By following Laravel's best practices, it helps developers build secure, scalable, and compliant user management systems.
Use Cases
- Setting up secure API authentication for mobile or SPA frontends using Laravel Sanctum's lightweight token system.
- Implementing a full-featured OAuth2 server for third-party integrations and secure cross-platform access using Laravel Passport.
- Integrating social authentication (OAuth) to allow users to sign in via Google, GitHub, or LinkedIn using Laravel Socialite.
- Defining granular user permissions and resource-level access control logic using Laravel Policies and Gates.
- Configuring secure backend authentication workflows, including email verification, password resets, and two-factor authentication with Fortify.
| name | laravel-auth |
|---|---|
| description | Implement authentication with Sanctum, Passport, Socialite, Fortify, policies, and gates. Use when setting up user authentication, API tokens, social login, or authorization. |
Laravel Authentication & Authorization
Documentation
Authentication
- authentication.md - Authentication basics
- sanctum.md - API token authentication
- passport.md - OAuth2 server
- fortify.md - Authentication backend
- socialite.md - Social authentication
- starter-kits.md - Breeze & Jetstream
Authorization
- authorization.md - Gates & Policies
Security
- verification.md - Email verification
- passwords.md - Password reset
- encryption.md - Encryption
- hashing.md - Hashing
- csrf.md - CSRF protection
- session.md - Session management
Sanctum Setup
use Laravel\Sanctum\HasApiTokens;
class User extends Authenticatable
{
use HasApiTokens, HasFactory, Notifiable;
}
Policy
<?php
declare(strict_types=1);
namespace App\Policies;
final class PostPolicy
{
public function update(User $user, Post $post): bool
{
return $user->id === $post->user_id;
}
public function delete(User $user, Post $post): bool
{
return $user->id === $post->user_id || $user->isAdmin();
}
}
Gates
Gate::define('admin', fn (User $user) => $user->role === UserRole::Admin);
// Usage
if (Gate::allows('admin')) { }