---

name: laravel-auth description: Implement authentication with Sanctum, Passport, Socialite, Fortify, policies, and gates. Use when setting up user authentication, API tokens, social login, or authorization. user-invocable: false

Laravel Authentication & Authorization

Documentation

Authentication

• authentication.md - Authentication basics
• sanctum.md - API token authentication
• passport.md - OAuth2 server
• fortify.md - Authentication backend
• socialite.md - Social authentication
• starter-kits.md - Breeze & Jetstream

Authorization

• authorization.md - Gates & Policies

Security

• verification.md - Email verification
• passwords.md - Password reset
• encryption.md - Encryption
• hashing.md - Hashing
• csrf.md - CSRF protection
• session.md - Session management

Sanctum Setup

Copyuse Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}

Policy

Copy<?php

declare(strict_types=1);

namespace App\Policies;

final class PostPolicy
{
    public function update(User $user, Post $post): bool
    {
        return $user->id === $post->user_id;
    }

    public function delete(User $user, Post $post): bool
    {
        return $user->id === $post->user_id || $user->isAdmin();
    }
}

Gates

CopyGate::define('admin', fn (User $user) => $user->role === UserRole::Admin);

// Usage
if (Gate::allows('admin')) { }