If you started following the forum series since the release of Laravel 11, you won't even have Sanctum installed, because it's no longer required by Laravel out of the box. So this only really applies to those of you who have just upgraded to Laravel 11 with me in the last episode. Sanctum's not doing anything wrong, but it's also not doing anything for us. We don't need Sanctum because there are no plans in this forum to support a public-facing API. Now, it should be fairly straightforward to uninstall Sanctum, so here's what I want you to do. I want you to save all of your current progress to Git, and then I want you to go ahead and

you to do. I want you to save all of your current progress to git, and then I want you to go ahead and try to uninstall Sanctum yourself. Pause the video, go and do it yourself. You'll probably run into a few little roadblocks, but no doubt you'll be able to overcome them. And once you get to the state where either you're so frustrated because things aren't working that you give up, or that you've actually successfully uninstalled Sanctum and everything's working again, come back and see how I do it. All right, see you in a minute. And welcome back.

All right, see you in a minute. And welcome back. I really hope you were successful, but honestly, don't panic if not, reset git, and let's go ahead and do this together. I'll find all usages of the word Sanctum, I'll mask by php file, and I'm going to ignore case. I can go ahead in PHPStorm and open in find window to return all instances here. Of course, if you don't have those filtering options available in your IDE, you can absolutely just search for the word Sanctum everywhere and ignore obvious things like the Laravel log.

just search for the word Sanctum everywhere and ignore obvious things like the Laravel log. The first instance is going to be the Sanctum.php config file, which we can remove. In User.php, it makes use of hasApiTokens, but we're not going to have API tokens, so we'll remove both usages there. Kernel.php has a comment for ensure from 10 requests a stateful, no need for that. Inside our API.php routes file, we have this example route that will just return the current user. No need for that example route. In fact, we could even remove API.php entirely, but I might keep it around because it can

No need for that example route. In fact, we could even remove API.php entirely, but I might keep it around because it can be useful for routes that just return JSON that we use internally. We'll decide at another time. Paths.php has Sanctum forward slash CSRF cookie. No need for that, so we'll remove it from the paths array. Jetstream.php references Sanctum as its default guard. We can change this to web to use standard cookie-based authentication that Laravel uses out of the box. Packages.php is auto-generated, so no need to change that file at all.

out of the box. packages.php is auto-generated, so no need to change that file at all. It will be updated when we update Composer in just a moment. Same with services.php, and then finally in web.php, we have root middleware auth Sanctum. Just remove the Sanctum and the colon. Change it to auth, and it will fall back to our standard auth, which is web. Now from the terminal, I can run composer remove laravel/sanctum, and it will go ahead and uninstall everything. Now if you attempted to do this the other way around, that is uninstall this package before removing reference to it throughout the codebase, this command would crash, and

Now if you attempted to do this the other way around, that is uninstall this package before removing reference to it throughout the codebase, this command would crash, and that can be confusing and annoying, and you might worry you've broken something, which is why I always remove reference first, and then remove the package using composer. Let's now run our test suite, so php artisan test, I'll run it in parallel, and we have a failure. Let's take a look at what the problem is. I'm going to open this test inside my IDE so I can easily run it in isolation, and we're not getting much of an error message here, so at the top, I'm going to say this, without exception handling and rerun, attempt to read property each on null, and it's coming from

not getting much of an error message here, so at the top, I'm going to say this, without exception handling and rerun, attempt to read property each on null, and it's coming from our deleteUser action, which is currently trying to delete the user's API tokens, which no longer exist would you believe it. So we can now remove that line entirely, rerun the test, and it passes. Let's just sense check and rerun all the tests again. All 85 tests are passing, which for me is enough proof that we have successfully uninstalled Sanctum and we're ready to move on.