Let's take a look at mobile app auth. So this isn't directly related to Fortify, but I figured I'd take a look at it anyways. So for authenticating non-browser apps, like mobile apps or Electron desktop apps, we can make use of bare tokens in Sanctum. So we create a login endpoint, and if the provided credentials are correct, Sanctum will return a token. You can then store that token on the client side, and then make use of that token on any protected routes. So let's go ahead and take a look. So first thing we have to do is add a HasApiTokens trait, which is up here in the docs.

So let's go ahead and take a look. So first thing we have to do is add a HasApiTokens trait, which is up here in the docs. So let's add this HasApiTokens on our User model, User, let's add it here, okay, make sure to import that. And now if we scroll back down, there should be an example login endpoint here. Right here. So I'm going to grab all this. And you can name the endpoint, whatever you want, I'll just stick to Sanctum token. So this is validating the request with email, password, and a deviceName. And the deviceName is just a string for whatever device the User is using, as it says here.

So this is validating the request with email, password, and a deviceName. And the deviceName is just a string for whatever device the User is using, as it says here. And then we are looking for the User here. And if their password is correct, then create a token for them and return it. So I'm going to add this route to our routes/api.php right here. So there should be right here. Okay, and let's go ahead and import everything that we need. So I'm just gonna copy this and paste it up here. And request is already there. So that should be fine.

And request is already there. So that should be fine. Okay. And now let's go ahead and create an endpoint or not create an endpoint. Let's make use of this endpoint in our REST client. So it's /sanctum/token. So let me just grab this, make a new one. Let's call it mobileOff. It's a POST request. Create paste /api/sanctum/token.

It's a POST request. Create paste /api/sanctum/token. Yep. Okay. And it's set the headers like we've been doing. And if you don't pass anything here, this should result in an unauthorized error. Sorry, I mean, invalid error. So let's go ahead and pass in that data. So let's visit email, password and deviceName. So let's add that.

So let's visit email, password and deviceName. So let's add that. So I already have a User with this email. Password is password. And like I said, deviceName can be whatever you want. So let's just say mobileApp. Okay. And if I did this correctly, this should result in a token. Sorry, deviceName can't spell. I'm actually rerecording these videos because I had audio issues.

So it's API user name doesn't matter. I'm going to make a request to this endpoint here, which is protected and just returns the user's information. So let's try that again. The endpoint is /api/user and set the headers again. Okay. And if I don't add a token, this should be unauthorized. And it is or unauthenticated. But if I set the correct Authorization header token, so it should be Authorization and the value should be Bearer and then the token.

But if I set the correct Authorization header token, so it should be Authorization and the value should be Bearer and then the token. So let me paste in the token. Okay. And if I did this correctly, this should result in this User's information. And I did not fill this in correctly. Should be Authorization. Try again. And there it is. So yeah, definitely make use of Sanctum if you need mobile authentication with tokens.

And there it is. So yeah, definitely make use of Sanctum if you need mobile authentication with tokens.