What are Laravel API authentication options, Sanctum or Passport?

Sanctum is Laravel's default lightweight option for SPA authentication, mobile app tokens, and simple machine to machine API keys. Passport is the heavier full OAuth 2.0 server you reach for when you need third party developer access (think your customers building apps on your API) with scopes, refresh tokens, and authorisation code flow. For most apps Sanctum is enough. We choose Passport only when the product genuinely needs an OAuth provider role.