Skip to main content

Authentication

Overview​

Smart Academic Hub uses Laravel Sanctum for secure API authentication. Sanctum provides both token-based authentication for mobile apps and cookie-based authentication for SPAs.

Authentication Flow​

  1. Registration: Create new user account
  2. Login: Authenticate with email and password
  3. Token Generation: Receive Sanctum access token
  4. API Requests: Include token in Authorization header
  5. Token Refresh: Not required - tokens are long-lived and can be revoked
  6. Logout: Revoke tokens from database

Endpoints​

Register​

POST /api/v1/auth/register

Login​

POST /api/v1/auth/login

Logout​

POST /api/v1/auth/logout

Get Current User​

GET /api/v1/auth/me

Token Usage​

Include the Sanctum token in the Authorization header:

Authorization: Bearer {your-token-here}

Security Features​

  • Password Hashing: Bcrypt with appropriate cost factor
  • Token Expiration: Configurable token lifetime
  • Rate Limiting: Prevent brute force attacks
  • CORS: Configured for frontend domains
  • Input Validation: All inputs are validated and sanitized

Role-Based Access Control (RBAC)​

Users have roles that determine their permissions:

  • Super Admin: System-wide administration
  • Academy Admin: Academy-level management
  • Staff: Teaching and administrative functions
  • Parent: View student information
  • Student: Access learning materials

Middleware​

  • auth:api: Validates Sanctum tokens using Laravel's built-in authentication
  • AcademyScopeMiddleware: Ensures multi-tenant data isolation