Okay, let's take a look at tokens. API tokens allow third-party services to authenticate with your application. So a good example of this is Laravel Forge. Forge allows you to create and manage servers, and they also have an API you can use to access the features programmatically. However, in order to use the API, you need to generate a token, which you can do from the Forge dashboard. So you can see the dashboard here. I've created a test token, and I've already copied the API token. And in my REST client, you can see that I have this Forge endpoint here.

I've created a test token, and I've already copied the API token. And in my REST client, you can see that I have this Forge endpoint here. I pasted in the token here, and this lists out my servers in Forge. So this is actually a feature of Laravel Sanctum, but it's built right into Jetstream. So here's how it looks in the Jetstream dashboard. So let's create a new token here. Let's call it myToken. Let's give it some permissions. Say everything for now. We can modify it after.

Say everything for now. We can modify it after. And let's create. And let's go ahead and copy this because we only see it once. Okay. So if you look at the documentation, you'll see that you can create different permissions, and we already have create, read, update, and delete by default. So if we go into our code, it's going to JetstreamServiceProvider, the one in our app. Since we're making use of Teams, there's already some default roles and some permissions associated with them.

Since we're making use of Teams, there's already some default roles and some permissions associated with them. So if I paste that code in, this is not going to do anything because we already have create, read, update, and delete. So what it does is merge all the permissions together. So if I were to change... Let me show you that first, actually. So back in here, nothing changes. We still have the four permissions. But if I were to change the name of these, and remember, permissions are just strings.

We still have the four permissions. But if I were to change the name of these, and remember, permissions are just strings. So you can just define them in here. And now there should be eight of them, and there are. So since they are just strings, you can do whatever you like in here. For example, if you want to namespace your permissions, say post create, and you can do that as well. But I'm just going to leave it as default here. And since we already have permissions for the two roles, then I'll just comment this out.

And since we already have permissions for the two roles, then I'll just comment this out. Okay. Now let's actually make use of this API key. So if we go into our routes/api.php, then you'll see this default route for just displaying the logged in user. And as you see, it's making use of the auth:sanctum middleware, so it can authenticate the token coming through. So let's go ahead and try this. Let's go into my REST client.

So let's go ahead and try this. Let's go into my REST client. Let's make a new one. Let's call it Jetstream tokens. Okay. And the endpoint is lc-jetstream-example.test/api/user. Right. Yeah. And that's a GET request. Let's add some headers.

And that's a GET request. Let's add some headers. So let's accept application/json. Okay. And this should be unauthorized because we didn't pass through the token. But if we pass the token in, I'll just pass in a Bearer token, paste that in. I believe it's the second thing in my clipboard. Now this should return information about the logged in User or the User that created the token actually. And there we go.

token actually. And there we go. So this authenticates the token, but we're not taking a look at the permissions yet. So to respect the permissions, there is this tokenCan method that we can make use of. Let's grab this and let's take a look at how we can use this. So right now we have permissions for everything. So create, read, update, or delete. So if I were to put this in a conditional, this should still work. And this is for, let's start with create here. And if it doesn't, let's just abort.

And this is for, let's start with create here. And if it doesn't, let's just abort. And let's say 401, I believe is unauthorized. Okay. And this should still work because we do have access to creating. But if I were to change that permission, then we should get a 4041 or whatever I put in the abort. So let's try that. So let's change permissions for, let me just refresh this. Let's remove the create permission for this token.

So let's change permissions for, let me just refresh this. Let's remove the create permission for this token. And now we should get that 401 Unauthorized response. And we do. Cool. So yeah, if you want to make an API and provide your users to generate a token, Jetstream as well as Sanctum makes it really easy to do that.