CHANGELOG.md

Release Notes

Unreleased

v4.3.1 - 2026-02-07

• [4.x] Supports Laravel 13 by @crynobone in laravel#587

v4.3.0 - 2026-01-22

• Add optional last_used_at tracking configuration by @MElkmeshi in laravel#583
• [4.x] Fix tests by @jackbayliss in laravel#584
• [4.x] Fix failing test on Laravel > 11 by @jackbayliss in laravel#585
• [4.x] Use property promotion by @jackbayliss in laravel#586

v4.2.4 - 2026-01-15

• Allow nullable $passwordHash by @BnitoBzh in laravel#582

v4.2.3 - 2026-01-11

• Allow null password hash by @patrickomeara in laravel#581

v4.2.2 - 2026-01-06

• Support HMAC password hash format from Laravel 12.45.0+ by @ams-ryanolson in laravel#578

v4.2.1 - 2025-11-21

• [4.x] Remove @return docblocks on constructors by @CasEbb in laravel#575
• [4.x] PHP 8.5 Compatibility by @crynobone in laravel#576

v4.2.0 - 2025-07-09

• [Refactor] Add indexes to personal_access_tokens by @keshav-k3 in laravel#571

v4.1.2 - 2025-07-01

• [4.x] Factor token last_used_at update into separate method by @cosmastech in laravel#567
• refactor: use text for name column by @reidsolon in laravel#570

v4.1.1 - 2025-04-23

• Fixes inconsistency in Sanctum::currentApplicationUrlWithPort() and Sanctum::currentRequestHost() by @denjaland in laravel#565

v4.1.0 - 2025-04-22

• Update logo by @iamdavidhill in laravel#562
• Feature to treat same domain requests to be from frontend and make stateful by @denjaland in laravel#564

v4.0.8 - 2025-01-26

• Supports Laravel 12 by @crynobone in laravel#556

v4.0.7 - 2024-12-11

• [4.x] Add tokenCant() helper function to HasApiTokens by @chester-sykes in laravel#552

v4.0.6 - 2024-11-26

• Add leading slash to @template tag in HasTokens by @omnicolor in laravel#550

v4.0.5 - 2024-11-26

• [4.x] Supports PHP 8.4 by @crynobone in laravel#542
• [4.x] Remove generic requirement that token is an instance of a Model by @cosmastech in laravel#549

v4.0.4 - 2024-11-15

• [4.x] Add Generics to HasApiTokens by @cosmastech in laravel#544
• [4.x] Add generics by @cosmastech in laravel#545

v4.0.3 - 2024-09-27

• Fix: Cast Model Key to Integer for PostgreSQL Performance Improvement by @BakhadyrovF in laravel#524
• Revert "Fix: Cast Model Key to Integer for PostgreSQL Performance Improvement" by @driesvints in laravel#526
• Replace dead link in Security Policy by @Jubeki in laravel#528
• Update logo to support dark/light theme by @milewski in laravel#536

v4.0.2 - 2024-04-10

• Fix/unable to logout by @GigaGiorgadze in laravel#511

v4.0.1 - 2024-03-19

• [4.x] Make commands lazy by @timacdonald in laravel#502

v4.0.0 - 2024-03-12

• [4.x] Adds Laravel 11 support by @nunomaduro in laravel#480
• Matching method to contract for createToken() by @gammamatrix in laravel#498

v3.3.3 - 2023-12-19

• Updated CsrfCookieController to use named arguments by @OussamaMater in laravel#487
• Extract generate token method by @mowangjuanzi in laravel#488

v3.3.2 - 2023-11-03

• Fix typo in config by @cosmastech in laravel#476
• Accept null as a parameter for Sanctum[@getAccessTokenFromRequestUsing](https://github.com/getAccessTokenFromRequestUsing)() by @cosmastech in laravel#477

v3.3.1 - 2023-09-07

• Re-arrange middleware by @taylorotwell in https://github.com/laravel/sanctum/commit/d1f8bf7f2bdc39ba2a11f1d067b96d31d18246c8

v3.3.0 - 2023-09-04

• Use crc32b instead of crc32 by @marzvrover in laravel#468
• Ensure device has not been logged out by @crynobone in laravel#467
• Do not prefix by default by @taylorotwell https://github.com/laravel/sanctum/commit/95a0181900019e2d79acbd3e2ee7d57e3d0a086b

v3.2.6 - 2023-08-22

• Make tokens identifiable with prefix and checksum by @marzvrover in laravel#459
• Add deprecated annotation in MissingScopeException by @hungthai1401 in laravel#462

v3.2.5 - 2023-05-01

• Fix middleware by @taylorotwell in https://github.com/laravel/sanctum/commit/8ebda85d59d3c414863a7f4d816ef8302faad876

v3.2.4 - 2023-04-26

• Check for validate CSRF token by @taylorotwell in https://github.com/laravel/sanctum/commit/f5bae6156c760545f368438198327e2609ba7bf1

v3.2.3 - 2023-04-25

• Revert "check for validate csrf token middleware" by @driesvints in https://github.com/laravel/sanctum/commit/6281ce796d464592867f768eb890642aa1954bd0

v3.2.2 - 2023-04-21

• Check for validate csrf token middleware by @taylorotwell in https://github.com/laravel/sanctum/commit/bbcb052de3fe075a67446e8c5c8ffcb191a1fb24

v3.2.1 - 2023-01-13

Fixed

• Fix bearer token format validation by @krasucki in laravel#417

v3.2.0 - 2023-01-06

Added

• Laravel v10 Support by @driesvints in laravel#415

v3.1.0 - 2023-01-03

Changed

• Uses PHP Native Type Declarations 🐘 by @nunomaduro in laravel#405

v3.0.1 - 2022-07-29

Changed

• Update migration's primary identifier change by @suyar in laravel#386
• Prune expires_at tokens by @iruoy in laravel#385

v3.0.0 - 2022-07-25

Added

• Expiration dates for tokens by @bjhijmans in laravel#252

Changed

• Improves console output by @nunomaduro in laravel#382
• Shorter tokens by @taylorotwell in https://github.com/laravel/sanctum/commit/c46fc083ab52f2ddac97ee4510486f90fc94f220

Removed

• Drop old Laravel and PHP versions by @driesvints in laravel#378

v2.15.1 - 2022-04-08

Changed

• Added custom auth token header support by @CodesignDev in laravel#354

v2.15.0 - 2022-03-28

Added

• Add sanctum:prune-expired command for removing expired tokens. by @yuraplohov in laravel#348

Fixed

• Add exit codes to command by @driesvints in laravel#351

v2.14.2 - 2022-02-22

Changed

• Use config function by @taylorotwell in commit

v2.14.1 - 2022-02-15

Changed

• Add helper for current app url with port (5702317)

v2.14.0 (2022-01-12)

Changed

• Laravel 9 support (#329)

v2.13.0 (2021-12-14)

Added

• Add an event on successful token validation (#327, b656bc1)

v2.12.2 (2021-11-16)

Changed

• Add guard to config (f811d5c)

v2.12.1 (2021-10-26)

Changed

• Rename CheckScopes and CheckForAnyScope to CheckAbilities and CheckForAnyAbility (#312)

v2.12.0 (2021-10-19)

Added

• Add CheckScopes and CheckForAnyScope Middleware (#310)

v2.11.4 (2021-10-13)

Fixed

• Revert "fix: replace hardcoded "web" guard by config('sanctum.guard')" (#309)

v2.11.3 (2021-10-12)

Fixed

• Replace hardcoded "web" guard by config('sanctum.guard') (#307)

v2.11.2 (2021-06-15)

Fixed

• Ignore updating last_used_at for deciding the DB connection host (#283, 2c8b9a1)
• Fix resolving wrong app instance on Octane (#285, #286)

v2.11.1 (2021-05-25)

Changed

• Only parse APP_URL for default stateful domains when it's set (#279)

v2.11.0 (2021-05-11)

Added

• Sanctum::$accessTokenAuthenticationCallback callback for more granular control over access token validation (#275, 9c07921, #276)

v2.10.0 (2021-04-20)

Added

• Add HasApiTokens contract to complement trait (#270)

v2.9.4 (2021-04-06)

Changed

• Use app helper (60f2809)

v2.9.3 (2021-03-30)

Changed

• Environment APP_URL added into the default sanctum.stateful configuration (#264)

v2.9.2 (2021-03-23)

Fixed

• Changed Primary Key will not be used in created token's plainTextToken (#262)

v2.9.1 (2021-03-09)

Fixed

• Avoid running string functions when domain is null (#258)

v2.9.0 (2021-01-26)

Added

• Add multiple guard support for SPA auth (#246, f5695ae)

Fixed

• Return json response when the request expects a json (#247)

v2.8.2 (2020-11-24)

Fixed

• Fix user provider in sanctum guard (#225)

v2.8.1 (2020-11-17)

Changed

• Add default nextjs address to stateful (e86d3e0)

v2.8.0 (2020-11-03)

Added

• PHP 8 Support (#213)

v2.7.0 (2020-10-20)

Added

• Adds origin header fallback (#204)

v2.6.0 (2020-09-01)

Changed

• Shorten tokens (#186)

v2.5.0 (2020-08-25)

Added

• Laravel 8 support (#184)

v2.4.2 (2020-06-16)

Fixed

• Use the correct Str::endsWith parameter order (#163)

v2.4.1 (2020-06-11)

Fixed

• Fix default statefull domains (#158, 2aac713)

v2.4.0 (2020-06-09)

Added

• Added Multiple Provider Support (#149)

Fixed

• Fixed Host Problem (#155)

v2.3.3 (2020-05-26)

Fixed

• EncryptCookies middleware option in config/sanctum.php (#147)

v2.3.2 (2020-05-21)

Added

• Add routes config option (6cf798f)

v2.3.1 (2020-05-12)

Fixed

• 419 Exception with requests without referrer (#139)

v2.3.0 (2020-05-05)

Changed

• More performant tokens lookup (#136)

v2.2.1 (2020-04-21)

Fixed

• No need to specify a provider (#129)

v2.2.0 (2020-04-14)

Added

• Allow customizing the query used to get the token (#124)

v2.1.2 (2020-04-09)

Fixed

• Enhance supportsTokens check (#123)

v2.1.1 (2020-04-07)

Fixed

• actingAs any ability (#120)

v2.1.0 (2020-03-24)

Added

• Make the guard configurable (#110)

v2.0.0 (2020-03-20)

Changed

• Renamed package to Sanctum

v1.0.1 (2020-03-12)

Fixed

• Allow localhost ip access by default (#81)
• Update minimum Laravel version to ^6.9 (#89)
• Fix wildcard matching (d8de232, 9a66e76)

v1.0.0 (2020-03-03)

First stable release.

v0.2.1 (2020-02-12)

Changed

• Allow .env configuration of stateful domains (#70)

v0.2.0 (2020-01-28)

Added

• Added user mocking using actingAs (#51)
• Add a CSRF middleware config variable (#54, 4f77acd, 7df454d)

Changed

• Modify PersonalAccessToken Model to be polymorphic (#49)

v0.1.0 (2020-01-20)

Initial commit.