Now, we can protect our endpoints using the api.auth middleware. This middleware checks for user authentication and gets user from JWT. However, the first thing is to make the user log in, create a token based on that user information, and return the signed token to the client.
In order to have authentication working, we first need to create an authentication-related controller. That controller will not only do token creation based on user login, it will also make the user token expire and refresh the token. In order to do this, we can put this open source AuthController in the app/Http/Controllers/Auth/ directory at https://github.com/Haafiz/REST-API-for-basic-RPG/blob/master/app/Http/Controllers/Auth/AuthController.php.
