The three HTTP surfaces

A Laraplate application answers on three prefixes. Each one has its own audience and its own way of signing in.

/admin

The backoffice, built with Filament. Superadmins manage users, roles, settings and the resources every module adds. Each module registers its own pages and navigation group.

/app

The session API for your own frontend. It uses the web guard, so a browser signs in with a session cookie, and Sanctum's stateful support lets a single page application on a trusted domain do the same. It carries the CRUD routes (/app/crud/...) and authentication (/app/auth/...).

Some operations exist only here and are never available on /api/v1: activate and inactivate, approve and disapprove, lock and unlock.

/api/v1

The optional public headless API. It uses the api guard and is switched off by default.

• The master switch is expose_api. Its default is false in Modules/Core/config/config.php, and a runtime setting of the same name (Filament, Settings) overrides it. While it is off, every /api route answers 403. The switch covers Core and every module.
• A request without a token runs as the anonymous user, which can read only what the guest role of the api guard is allowed to read.
• A request with a bearer token (Sanctum personal access token) runs as that user. A token that is unknown, malformed, expired or revoked is refused with 401; it never falls back to the anonymous user. A superadmin's token also gets 401.
• Requests are limited to 600 a minute per token, or per client address when there is no token.

Which one to use