Authentication answers "who is this?"; authorization (Authorization) answers "may they?". The framework supplies guards, user providers, the hasher and the reset broker; the starter kits and Fortify 1,761 supply the routes and screens. Every request below was made with curl 3,008 against php artisan serve --port=8314 on Laravel 13.33.0 2,157 and Fortify 1.40.0, with SQLite 4,756 and MAIL_MAILER=log, so every email lands in storage/logs/laravel.log. Sanctum 2,988 and API tokens wait for APIs and Real Time.