What is causing /api/user on Sanctum to return 401 Unauthenticated?-CodePudding

My API is on api.domain.test and my SPA is on spa.domain.test.

spa.domain.test is a proxy to localhost:3000 running Next.js server.

api.domain.test is your standard folder served out of Valet.

I am running latest Laravel and I set up Breeze with the --api configuration.

.env

APP_URL=https://api.domain.test
FRONTEND_URL=https://spa.domain.test
SESSION_DOMAIN=.domain.test
SESSION_DRIVER=file

Requests to sanctum/csrf works. Requests to /login works. But not /api/user. 401.

I inspected the Chrome network and I see the Cookies are in Request Headers too. Still.

I've spent literally a day figuring it out. Any help will be appreciated. Thanks.

CodePudding user response：

Make sure your domain is added to config/sanctum stateful property as the docs shows in the .env file sanctum config

'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS')),

Don't forget to cache the config after editing .env file

php artisan config:cache