title: First Party use of Laravel Passport
body: <p>I'm using Laravel Passport for API authentication,</p>
  <p>This is my stack:</p>
  <ul>
  <li><code>ReactJs (front-end)</code></li>
  <li><code>Laravel (backend - API)</code></li>
  </ul>
  <p>Currently I'm giving Personal Access Tokens directly to users like this, and after getting the token user's can access protected routes as usual:</p>
  <pre class="lang-php prettyprint-override"><code>    public function login(LoginRequest $request)
      {
          $request-&gt;authenticate(); // it authenticate the user based on $request-&gt;email and $request-&gt;password
          
          /** @var User $user */
          $user = Auth::user();
          $token = $user-&gt;createToken('auth');
  
          return response([
              'message' =&gt; 'success',
              'user' =&gt; $user,
              'token' =&gt; $token-&gt;accessToken,
          ]);
      }
  </code></pre>
  <p>It works fine but the problem is now, anyone can get their token directly using tools like Postman, and use that token to access protected routes. which I don't want.</p>
  <p>I only want the users to access the routes via my whitelisted frontends. like <code>Reactjs SPA</code> etc..</p>
  <p>I read some articles sugesting to whitelist our domains on <code>config/cors.php</code>, it works for modern browsers, but still tools like postman would work. :(</p>
  <p>Is there any-way I can acheive this?</p>
  <p>Thank you so much for reading.</p>