Drop full Laravel authentication into the Next.js App Router. <code>next-sanctum</code> handles stateful cookie/CSRF SPA sessions (and tokens), Server Components and client hooks (<code>useAuth</code>, <code>useUser</code>), plus 2FA and WebAuthn passkeys — all through a same-origin proxy, so there’s no CORS. Tiny footprint (~6 kB), TypeScript-first.
Links:
<ul>
<li>npm: <a href="https://www.npmjs.com/package/next-sanctum" target="_blank" rel="noopener nofollow">https://www.npmjs.com/package/next-sanctum</a></li>
<li>GitHub: <a href="https://github.com/aliziodev/next-sanctum" target="_blank" rel="noopener nofollow">https://github.com/aliziodev/next-sanctum</a></li>
</ul>

Muhamad Hanafi

next-sanctum is a TypeScript-first npm library that integrates Laravel Fortify and Sanctum authentication into Next.js App Router applications. It supports stateful cookie/CSRF SPA sessions and token-based auth, works with both Server Components and client-side hooks (useAuth, useUser), and includes 2FA and WebAuthn passkey support. A same-origin proxy eliminates CORS issues entirely, and the package weighs in at ~6 kB.

next-sanctum: complete Laravel Fortify + Sanctum auth for Next.js — 2FA & passkeys, zero CORS