Laravel App Build: Eloquent, Sanctum, Queues, Livewire
Laravel 12/13 code that ships: N+1-free Eloquent, correct Sanctum mode, idempotent queued jobs, lean Livewire, and Pest tests.
Before & after
Same prompt, same agent — the only difference is the skill.
Laravel is a good choice for building APIs. You'll want to set up models, routes, and controllers. For authentication, Sanctum is the way to go for SPAs. Background jobs would use queues and probably Laravel Horizon for monitoring. There are a lot of moving parts to think about, but the framework handles a lot of the boilerplate.
LARAVEL API SCAFFOLD + SETUP GUIDE
STEP 1: MODELS + MIGRATIONS
→ php artisan make:model User -m
→ User model with: name, email, password, api_token
→ Migration: users table with indexed email
STEP 2: SANCTUM AUTH
→ composer require laravel/sanctum
→ php artisan vendor:publish --provider=SanctumServiceProvider
→ In User model: use HasApiTokens
→ Route protection: middleware('auth:sanctum')
→ Login endpoint returns token: auth()->user()->createToken('API Token')
STEP 3: API ROUTES (routes/api.php)
POST /auth/login → AuthController@login
GET /user → protected endpoint
POST /logout → AuthController@logout
STEP 4: JOB SETUP
→ php artisan make:job ProcessEmailQueue
→ Database queue driver (set in .env: QUEUE_CONNECTION=database)
→ Migration: php artisan queue:table
→ In controller: ProcessEmailQueue::dispatch($data)
STEP 5: HORIZON (Job Monitoring)
→ composer require laravel/horizon
→ php artisan horizon:install
→ Start workers: php artisan horizon
→ Dashboard at /horizon (protected with gate)
TESTING WITH PEST
→ test('user can login', function() { ... })
→ Fake queue: Queue::fake(); assertDispatched()
→ Test timeout scenarios and retry logic
DEPLOYMENT: Ensure queue:work runs as separate process on production.About this skill
Your Laravel endpoint is fine with 10 seeded rows and runs 300 queries in production. Your queued job charges a customer twice. Your SPA gets 419 CSRF errors after moving to a subdomain. This skill writes Laravel 12/13 code that avoids those failures, and it diagnoses them fast when they already happened.
What it does
- Writes for your actual skeleton. It uses bootstrap/app.php middleware,
casts(), andGate::authorize, and it adapts when an upgraded app still has an Http Kernel. - Finds and fixes N+1s at the query and in API resources using column-scoped eager loads,
withCount,whenLoaded, and strict mode. It then locks the fix in with a query-count test. - Picks the right Sanctum mode for each client: SPA cookie or API tokens. It debugs 401 and 419 errors in the order that finds the cause fastest, and it tells you when you actually need Passport.
- Makes queued jobs safe under retries and deploys. That covers timeout ordering, after-commit dispatch, idempotency, and separate Horizon supervisors so bulk work cannot starve urgent jobs.
- Builds Livewire components that do not leak or trust client state, using locked properties, computed properties, and authorization on every action.
- Writes Pest tests for the rules that matter: the 403, the dispatched job, the database state, and the query count. A route returning 200 is not enough.
What you get
Path-labeled files ready to drop in: migration, model, request, policy, controller, resource, job, component, and Pest tests. You also get deploy notes. Pasted code gets a ranked review with replacement code.
Best for
Laravel developers and small teams building APIs, SPAs, or Livewire apps who want production-grade defaults without a senior reviewer on every PR.
SKILL.md preview
---
name: laravel-eloquent-sanctum-queues-livewire
… (sign up to view the full skill)More development skills
View all Development skills →Production Go: Concurrency, Services & Profiling
Production Go code with leak-free goroutines, context-correct services, wrapped errors, and pprof-driven performance fixes.
Backend Feature Build Plan
Builds one backend feature through gates: confirmed requirements, one-screen design, small tested slices, and a deploy/rollback handoff.
Consistent, Safe Application Logging
Adds structured, correlated logs with useful severity, safe fields, bounded volume, and targeted verification.
Reliable WebSocket Messaging and Scaling
Build WebSocket and Socket.IO systems with authorized rooms, reconnect recovery, bounded queues, and multi-node presence.