# Laravel Sanctum: {"message":"Unauthenticated."} 401 on API / SPA requests

**Code:** `Sanctum: 401 Unauthenticated` · **Category:** Laravel · **Seen on:** Laravel, PHP

A request to a `auth:sanctum` route had no valid token or session, so Laravel returned 401.

## Meaning

For token auth send `Authorization: Bearer TOKEN` and `Accept: application/json`. For SPA auth call `/sanctum/csrf-cookie` first, set `withCredentials`, configure `SANCTUM_STATEFUL_DOMAINS`, `SESSION_DOMAIN` and CORS `supports_credentials`. Missing `Accept: application/json` yields a redirect to `/login` instead.

## Common causes

- No bearer token or wrong header
- SPA missing csrf-cookie call / withCredentials
- Domain not in SANCTUM_STATEFUL_DOMAINS
- SESSION_DOMAIN/cookie settings wrong
- Token revoked or expired

## Quick fix

1. Send `Accept: application/json` and `Authorization: Bearer ...`
2. SPA: call `/sanctum/csrf-cookie` first and set `SANCTUM_STATEFUL_DOMAINS`
3. Check CORS `supports_credentials => true`

## Detailed fix by platform

### Linux

1. `curl -H "Accept: application/json" -H "Authorization: Bearer TOKEN" https://app.test/api/user`

## How to diagnose

1. **Mode** — Token or SPA?
2. **Headers** — Accept/Authorization?
3. **Domains** — Stateful config?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/laravel/sanctum-unauthenticated)