Authentication

The starter ships with a full token-based auth system under the /auth prefix. No sessions, no cookies. Sanctum personal access tokens handle everything.

Most of this is stock Laravel and Sanctum with a few tweaks for a headless API:

• Soft-deleted accounts can restore themselves by logging in during a configurable grace period
• Email verification uses short codes instead of signed URLs, since there's no server-rendered page to land on. The client collects the code and submits it.
• Verification mode is configurable: disabled, auto-verify on register, or required with optional grace period

Guest endpoints (register, login, forgot/reset password, email change confirmation) are throttled. Authenticated endpoints (logout, token refresh) require a valid Sanctum token.

See Login and Token Lifecycle for token expiration, refresh behavior, and remember-me patterns. See Password Reset for the two-step reset flow. See Email Change for how email swaps are confirmed from the new inbox.