laravel/framework · error · AuthenticationException

Unauthenticated.

Error message

Unauthenticated.

What it means

Thrown as AuthenticationException by the Authenticate middleware when none of the configured guards can authenticate the current request. It carries the list of guards checked and a redirect target (null for JSON requests). This is the standard '401-style' signal that an unauthenticated user reached a protected route.

Source

Thrown at src/Illuminate/Auth/Middleware/Authenticate.php:101

                return $this->auth->shouldUse($guard);
            }
        }

        $this->unauthenticated($request, $guards);
    }

    /**
     * Handle an unauthenticated user.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  array  $guards
     * @return never
     *
     * @throws \Illuminate\Auth\AuthenticationException
     */
    protected function unauthenticated($request, array $guards)
    {
        throw new AuthenticationException(
            'Unauthenticated.',
            $guards,
            $request->expectsJson() ? null : $this->redirectTo($request),
        );
    }

    /**
     * Get the path the user should be redirected to when they are not authenticated.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return string|null
     */
    protected function redirectTo(Request $request)
    {
        if (static::$redirectToCallback) {
            return call_user_func(static::$redirectToCallback, $request);
        }
    }

View on GitHub (pinned to e0f6eb3518)

Solutions

1. For web: ensure the user logs in (redirect to login is automatic via redirectTo()).
2. For API: send a valid token/credential (Bearer token, Sanctum SPA cookie, etc.) in the request.
3. Verify the correct guard is applied to the route and that the session/token is actually valid.
4. Check that session lifetime and Sanctum stateful domains are configured for your SPA.
5. Handle the exception globally to return a JSON 401 for API clients via Handler/ExceptionHandler.

Example fix

// before — calling a protected API without a token
// GET /api/me   ->  AuthenticationException('Unauthenticated.')

// after — send a valid bearer token
// headers: Authorization: Bearer <sanctum-token>
$response = Http::withToken($token)->get('/api/me');

// global handler for API responses
protected function unauthenticated($request, AuthenticationException $e)
{
    return $request->expectsJson()
        ? response()->json(['message' => $e->getMessage()], 401)
        : redirect()->guest(route('login'));
}

// PHP — detect unauthenticated state before protected work
if (! Auth::guard($guard)->check()) {
    return $request->expectsJson()
        ? response()->json(['message' => 'Unauthenticated.'], 401)
        : redirect()->guest(route('login'));
}
// proceed with protected logic

function isAuthenticated(string $guard = null): bool {
    return Auth::guard($guard)->check();
}

try {
    // route runs the auth middleware
} catch (\Illuminate\Auth\AuthenticationException $e) {
    return $request->expectsJson()
        ? response()->json(['message' => $e->getMessage()], 401)
        : redirect()->guest($e->redirectTo($request) ?? route('login'));
}

When it happens

Trigger: A request without a valid session/token hits a route protected by the 'auth' or 'auth:guard' middleware; token-based requests where the token is missing/invalid/expired; session guards where the session expired or was never established.

Common situations: Accessing a protected page after session timeout; calling an API route without the auth token header; misconfigured Sanctum/Passport stateful domains causing SPA auth to fail; route middleware ordering placing 'auth' before 'auth:api' on JSON endpoints.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid credentials.
• Auth guard [{$name}] is not defined.
• Auth driver [{$config['driver']}] for guard [{$name}] is not
• Unable to bind custom driver callback
• Authentication user provider [{$driver}] is not defined.

AI-assisted analysis of laravel/framework@e0f6eb3518 (2026-08-11). Data as JSON: /api/errors/914df3c3b6f08535. Report an issue: GitHub.