title: Laravel 8 API email verification flow using Sanctum
body: <p>I'm currently making an API for a mobile app but I think I'm a bit confused with how email verification and authentication is meant to work. I'm attempting to implement the following flow:</p>
  <ul>
  <li>User registers in the mobile app and it sends a request to the API</li>
  <li>Laravel creates the user and fires off an email</li>
  <li>User receives the email and clicks on the link</li>
  <li>Laravel verifies the user and redirects them to the mobile app via deep-link</li>
  </ul>
  <p>However when the user clicks the email link a &quot;route login not defined&quot; error is rendered.
  Which makes sense, because the user is not authenticated at the time. But am I getting this wrong?</p>
  <p>Should I authenticate the user prior to sending the email? And will that work, given that we're using Sanctum rather than &quot;regular&quot; authentication?</p>
  <p>Currently this is what I'm doing:</p>
  <pre class="lang-php prettyprint-override"><code>// web.php
  
  Route::get('/email/verify/{id}/{hash}', [EmailVerificationController::class, 'verify'])
      -&gt;middleware('signed') //note that I don't use the auth or auth:sanctum middlewares
      -&gt;name('verification.verify');
  </code></pre>
  <pre class="lang-php prettyprint-override"><code>// EmailVerificationController.php
  
  public function verify(Request $request)
  {
      $user = User::findOrFail($request-&gt;id);
  
      if ($user-&gt;email_verified_at) {
          return '';
      }
  
      if ($user-&gt;markEmailAsVerified()) {
          event(new Verified($user));
      }
  
      return redirect()-&gt;away('app://open'); // The deep link
  }
          
  </code></pre>
  <p>Is there any security risk here? Should I at any point authenticate the user before or after they click the link?
  I wanted to avoid rendering &quot;web views&quot; as much as possible.</p>