Laravel Passport 401 following documentation

Question

I followed the documentation to install larval passport using larval 5.6. Currently when I hit any of my api routes with the api guard I will get an 401 http status on the request. I look threw hundreds or it seems like it discussions of this topic and can't seem to find something that work. Any help would be great.

Installed with composer
php artisan passport:install
put HasApiTokens in user model
Passport::routes(); in Auth provider
changed provider in config/auth.php
put this in web middle ware \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,

My request headers

Cache-Control: no-cache, private
Connection: keep-alive
Content-Type: application/json
Date: Thu, 17 May 2018 03:34:11 GMT
phpdebugbar-id: Xe76c4a977b813e9296e0705b5cd6bc05
Server: nginx
Transfer-Encoding: chunked
X-Powered-By: PHP/7.2.4
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59
POST /api/chat HTTP/1.1
Host: ct.test
Connection: keep-alive
Content-Length: 33
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/plain, */*
Origin: http://ct.test
X-XSRF-TOKEN: eyJpdiI6IkQ3K3o3SExMYVZEWnYyejJQXC9zUlpnPT0iLCJ2YWx1ZSI6Ijh6UWVtdDlzU0hIWnpqZmdmazhSc0FMWUU5MTQ1N1dXNStZVlk3amhIbjNmYmlhN3BwaEJwbTI0MU5qUjVFRUtqWWV2aW1Td3JvdDg0QTd6RWJzem9RPT0iLCJtYWMiOiJkMDE0MmU2NGY5NmY3YmIxZjAwMjI4OGM1ZDUzMTU5OTBmMjNkM2YxOTZkNzM5NTAyMzliZjc0YTgyMTUyZWQ4In0=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4)     AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36
Content-Type: application/json;charset=UTF-8
Referer: http://ct.test/chat/new
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: laravel_token=eyJpdiI6IlhMSERkejlyNFRodkZtUGdZekI2V2c9PSIsInZhbHVlIjoiK2lTbGZCN3NPWjU4aDNLdkNcLzhIRzJhTE8wVmxET1J1aXdsRUgwbEQ1am9MME5MekRCWHRGQkgzaDhlTVc3OTNrc1BlMXFVQXF1SDN1UWRMNXoyRjRFQXBnTmZwVng1T0RKcVwvYWFzWHB6QkpBcERPOXUzUXc2SHVkeXNsaHRsVUJJQkZSbDVxK2NFQmdiT012cytWYmVHQmpWY01LSno3NXdvbGZjT3RIK3pmMkRUTTBvUUE1OXJ0bUNmNzkyYktFVWdIbTQ0YmZuZ05YSEs4dE5mcW5zcnBod2h4d2JsTkxSTWk0bk53S2hyK3VrRnNlRGFuUHU4RzZBblwvalhGMFB4YlhHeUlmTm1JanFKaCtoQUxTNUE9PSIsIm1hYyI6IjdjNzQ0MTIzMDBkOTc4ZGQ1M2I5M2Q5MThmN2NiZDU4MDU2YjhjZDIyOWQzNDhhNDkyY2Q5NGM4ZTFkOTU3MzYifQ%3D%3D; XSRF-TOKEN=eyJpdiI6IkQ3K3o3SExMYVZEWnYyejJQXC9zUlpnPT0iLCJ2YWx1ZSI6Ijh6UWVtdDlzU0hIWnpqZmdmazhSc0FMWUU5MTQ1N1dXNStZVlk3amhIbjNmYmlhN3BwaEJwbTI0MU5qUjVFRUtqWWV2aW1Td3JvdDg0QTd6RWJzem9RPT0iLCJtYWMiOiJkMDE0MmU2NGY5NmY3YmIxZjAwMjI4OGM1ZDUzMTU5OTBmMjNkM2YxOTZkNzM5NTAyMzliZjc0YTgyMTUyZWQ4In0%3D; laravel_session=eyJpdiI6IkxTM0JiQVZPekFkb3VDaFh5MTRGNWc9PSIsInZhbHVlIjoiemxaTXZVNGlPWFFOS1o3MUx6NUgrWFc2dEFVQ1dZTUlOTWc2bUJvMXY1NVBISTZuVmFLVGlKOVNveXk0dTMyWXFjaDk1eTBlemxoa0pnWWRLWVNYR0E9PSIsIm1hYyI6ImJhNzRhM2FiYjc1Mzc4NTVlYzY3MWUwZjkwNzZlOWVhNDY3OWQ5MmNlOTc0MGM1MDg1YmViNDNjYjQ0M2Q0MDkifQ%3D%3D

My routes look like this

Route::middleware('auth:api')->group(function () {
    Route::post('/chat', 'ChatController@store');
});

You're not logged in. You aren't passing a Bearer token in your headers — DevK
@devk Yes I am logged in. The documentation says that everything is included in the headers. — John Freedom
The headers you posted do not include an Authorization: Bearer ... token, which is what Laravel Passport uses by default for authentication. Passing the token is done with Javascript, backend can't do it for you. Edit: I see, it can be done with cookie with the middleware you use. Sorry, my mistake here. Is the route you're tryinng to access in routes/web.php? — DevK
@devk This Passport middleware will attach a laravel_token cookie to your outgoing responses. This cookie contains an encrypted JWT that Passport will use to authenticate API requests from your JavaScript application. Now, you may make requests to your application's API without explicitly passing an access token: — John Freedom
Yes, you're right, I didn't know that. Is the route you're trying to access in routes/web.php? — DevK

Ohgodwhy Ohgodwhy · Accepted Answer · 2018-05-17T05:08:59

You're mixing API strategies. You quoted this:

This Passport middleware will attach a laravel_token cookie to your outgoing responses. ...

This is only true if you're wanting to internally consume your application. Which is fine, but as pointed out in your comments you must then use the web middleware, and not the auth:api middleware.

This of course assumes that you're using axios to make the request and have kept the default javascript that Laravel ships with that automatically injects the x-csrf-token into the axios headers. Without that, this will not work.

Laravel Passport 401 following documentation

1 Answers