title: How to enable both api and web guard in laravel
body: <pre><code>Laravel 5.7
  
  PHP 7.2.10
  </code></pre>
  
  <p>Currently I am able to use any one of web and api guards, is there any way to allow both, so that both web app and api will work together.</p>
  
  <p>Something like</p>
  
  <p>
  
  <pre><code>return [
  
      /*
      |--------------------------------------------------------------------------
      | Authentication Defaults
      |--------------------------------------------------------------------------
      |
      | This option controls the default authentication "guard" and password
      | reset options for your application. You may change these defaults
      | as required, but they're a perfect start for most applications.
      |
      */
  
      'defaults' =&gt; [
          'guard' =&gt; 'api|web',
          'passwords' =&gt; 'users',
      ],
  </code></pre>
  
  <p>with out using schema, <a href="https://stackoverflow.com/questions/39333744/how-to-use-web-and-api-guards-at-the-same-time-in-laravel">here</a> is a solution/workaround which needs changes in schema, what I will not prefer. Also I do not need access token for registration, what this answer is doing.</p>
  
  <p>api.php</p>
  
  <pre><code>Route::group([
      'middleware' =&gt; 'api|web',
      'prefix' =&gt; 'auth'
  ], function ($router) {
  
     Route::post('register', 'Auth\AuthController@register')-&gt;name('api.register');
      Route::post('forgot-password', 'Auth\ForgotPasswordController@forgotPassword')-&gt;name('api.forgot-password');
      Route::post('login', 'Auth\AuthController@login')-&gt;name('api.login');
      Route::middleware('auth')-&gt;post('logout', 'Auth\AuthController@logout')-&gt;name('api.logout');
  </code></pre>
  
  <p>web.php</p>
  
  <pre><code>Auth::routes(['verify' =&gt; true]);
  Route::prefix('admin')-&gt;group(function () {
   Route::middleware('auth', 'permission:super-admin|association-member')-&gt;resource('users', 'Auth\UserController');
  });
  </code></pre>
  
  <p>config/auth.php</p>
  
  <pre><code>return [
  
      /*
      |--------------------------------------------------------------------------
      | Authentication Defaults
      |--------------------------------------------------------------------------
      |
      | This option controls the default authentication "guard" and password
      | reset options for your application. You may change these defaults
      | as required, but they're a perfect start for most applications.
      |
      */
  
      'defaults' =&gt; [
          'guard' =&gt; 'web', //api
          'passwords' =&gt; 'users',
      ],
  
      /*
      |--------------------------------------------------------------------------
      | Authentication Guards
      |--------------------------------------------------------------------------
      |
      | Next, you may define every authentication guard for your application.
      | Of course, a great default configuration has been defined for you
      | here which uses session storage and the Eloquent user provider.
      |
      | All authentication drivers have a user provider. This defines how the
      | users are actually retrieved out of your database or other storage
      | mechanisms used by this application to persist your user's data.
      |
      | Supported: "session", "token"
      |
      */
  
      'guards' =&gt; [
          'web' =&gt; [
              'driver' =&gt; 'session',
              'provider' =&gt; 'users',
          ],
  
          'api' =&gt; [
              'driver' =&gt; 'jwt',
              'provider' =&gt; 'users',
          ],
      ],
  </code></pre>
  
  <p><strong>Update</strong>
  As @apokryfos said, <code>If you want both to work for both then yes. However, I think that's bad practice. API routes should only allow API authentication since web authentication usually uses the session which API routes don't use anyway. If I were you I'd take a step back and rethink my entire strategy.</code></p>
  
  <p><em>I too do not want to make both work for both, I just want to make work both api and web app parallelly, now I am able to use any one of them.</em></p>
  
  <p><strong>Update2</strong>
  As @Lim Kean Phang suggested the git issue link</p>
  
  <p>I changed </p>
  
  <pre><code>  protected function respondWithToken($token)
      {
          return response()-&gt;json([
              'access_token' =&gt; $token,
              'token_type' =&gt; 'bearer',
              'expires_in' =&gt;  auth('api')-&gt;factory()-&gt;getTTL() * 60,//auth()-&gt;factory()-&gt;getTTL() * 60,
              'status' =&gt; 200,
              "response" =&gt; "Successfully login",
          ]);
      }
  </code></pre>
  
  <p>The expires_in value, but now I am not getting the access token.</p>
  
  <p>The api response is</p>
  
  <pre><code>{
      "access_token": true,
      "token_type": "bearer",
      "expires_in": 31536000,
      "status": 200,
      "response": "Successfully login"
  }
  </code></pre>
  
  <p><strong>Update 3</strong>
  Added a <a href="https://github.com/tymondesigns/jwt-auth/issues/1746" rel="noreferrer">github</a> issue as could not find any possible solution to make it work.</p>