I've been having this dilemma when working with Laravel Passport and VueJS 2 for SPA. I have my backeend in place with my front-end on the same project. I've come to the point where I need to implement the authentication. During my back-end development, I've been using the Password Grant (of Passport) for the API. Everything works as intended.

As for the front-end, there is this section on Laravel Passport docs regarding consuming your own APi without the need of access token. Since I'm doing SPA, I don't actually like to have some sort of dedicated "login" page that "POSTS" explicitly to /login (forcing a redirect). Yes, it saves the session and everything. Is that okay to have this kind of implementation for a SPA? As for the authenticated user info, I've been thinking to use Laracast's JavasScript package to send the user info on the default route.

Would this approach break the standards? Should I stick with the regular Bearer access token, and handle the authentication info on the front-end alone? (with Vuex or auth service). Thanks!