@Rishabh-Webkul
Thank you for your answer.
Sorry for all the time.
The Bagisto APIs have the following code in parts
EnsureFrontendRequestsAreStateful::fromFrontend($request)
//* In bagisto/app/Http/Kernel.php, EnsureFrontendRequestsAreStateful is commented out, so SPA authentication is not working globally
I'm assuming this makes it work with both API tokens and SPA authentication? I felt that it would.
Also, as far as I can see, SPA authentication is already set up and I don't think there is anything special to do here.
Even if it needs to be configured or modified, we cannot modify bagisto itself or Bagisto APIs.
(We cannot do anything that would cause problems with future updates to the main body or other packages)
This made me think that Bagisto APIs are designed to have SPA authentication work for APIs that require SPA authentication when they are accessed by first parties.
Am I correct in this perception and can I assume that this is the usage recommended by the Laravel Sanctum?