Sanctum: 401 Unauthenticated Laravel Origin: Application & API Last updated 4 Nov 2026

Laravel Sanctum: {"message":"Unauthenticated."} 401 on API / SPA requests

A request to a auth:sanctum route had no valid token or session, so Laravel returned 401.

Exact message you may see Unauthenticated. 401 Laravel SanctumIlluminate\Auth\AuthenticationException: Unauthenticated.Sanctum 401 Unauthenticated SPAauth:sanctum Unauthenticated
Explore the map of this error Full error map →
Seen on: Laravel PHP

Meaning

For token auth send Authorization: Bearer TOKEN and Accept: application/json. For SPA auth call /sanctum/csrf-cookie first, set withCredentials, configure SANCTUM_STATEFUL_DOMAINS, SESSION_DOMAIN and CORS supports_credentials. Missing Accept: application/json yields a redirect to /login instead.

Common causes

  • No bearer token or wrong header
  • SPA missing csrf-cookie call / withCredentials
  • Domain not in SANCTUM_STATEFUL_DOMAINS
  • SESSION_DOMAIN/cookie settings wrong
  • Token revoked or expired

⚡ Quick fix

  1. Send Accept: application/json and Authorization: Bearer ...
  2. SPA: call /sanctum/csrf-cookie first and set SANCTUM_STATEFUL_DOMAINS
  3. Check CORS supports_credentials => true

Detailed fix by platform

Linux

  1. curl -H "Accept: application/json" -H "Authorization: Bearer TOKEN" https://app.test/api/user

How to diagnose

  1. Mode — Token or SPA?
  2. Headers — Accept/Authorization?
  3. Domains — Stateful config?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

403 This action is unauthorized — Laravel: Illuminate\Auth\Access\AuthorizationException: This action is unauthorized. (Laravel)403 This action is un…419 Page Expired — Laravel: 419 Page Expired (CSRF token mismatch) (PHP)419 Page Expired422 Unprocessable Entity: The given data was invalid — Laravel: {"message":"The given data was invalid.","errors":{"email":["The email field is required."]}} (422) (Laravel)422 Unprocessable Ent…429 Too Many Requests (Laravel throttle) — Laravel: Illuminate\Http\Exceptions\ThrottleRequestsException: Too Many Attempts. / 429 Too Many Requests (Laravel)429 Too Many Requests…Attempt to read property "x" on null — Laravel/PHP 8: ErrorException: Attempt to read property "name" on null (Laravel)Attempt to read prope…Command "x" is not defined — Laravel: Symfony\Component\Console\Exception\CommandNotFoundException: Command "make:livewire" is not defined. Did you mean one of these? (Laravel)Command "x" is not de…CORS blocked (Laravel API) — Browser: Access to XMLHttpRequest at 'https://api.example.com' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header — Laravel (Laravel)CORS blocked (Laravel…invalid csrf token — ForbiddenError: invalid csrf token (EBADCSRFTOKEN) (Authentication)invalid csrf tokenSanctum: …

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.