title: Confusing how Laravel passport API security works
body: <p>Client sends username and password to the server.</p>
  
  <p>Server then checks if this user is authenticated.</p>
  
  <p>If yes, the server returns an access token for the client...</p>
  
  <p>Then user can use this access token to access protected resources...</p>
  
  <p>The advantage here, is that we are not sending user info via API calls, and the access token will not last for long time, so hackers won't be able to find out user authentication info (user name and password), and if he finds out, the access token won't last long enough to do anything with it.</p>
  
  <p>That's how I understand Laravel passport API security.</p>
  
  <p>The confusing thing here, is that on first API call, user has to send user name and password, so hacker still have big chance to find out user info!!!</p>
  
  <p>I know that there is something wrong with my understanding, and that's why I get  confused, any explanation would be very appreciated.</p>