From b38ce26e34d185c283f40fbe76919f6540f6e15f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 1 Mar 2026 14:08:29 +0100
Subject: [PATCH] fix(auth): preserve Sanctum token prefix for lookups

Sanctum uses the numeric prefix (e.g. "69|...") in plaintext tokens
to index and look up tokens. Stripping this prefix breaks token
resolution.
---
 app/Livewire/Security/ApiTokens.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/Livewire/Security/ApiTokens.php b/app/Livewire/Security/ApiTokens.php
index ffd8f28cf..97d2bfb44 100644
--- a/app/Livewire/Security/ApiTokens.php
+++ b/app/Livewire/Security/ApiTokens.php
@@ -4,7 +4,6 @@ namespace App\Livewire\Security;
 
 use App\Models\InstanceSettings;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Str;
 use Laravel\Sanctum\PersonalAccessToken;
 use Livewire\Component;
 
@@ -122,7 +121,8 @@ class ApiTokens extends Component
             ]);
             $token = auth()->user()->createToken($this->description, array_values($this->permissions));
             $this->getTokens();
-            session()->flash('token', Str::after($token->plainTextToken, '|'));
+            // Do NOT strip the numeric prefix (e.g. "69|...") — Sanctum uses it to index and look up tokens.
+            session()->flash('token', $token->plainTextToken);
         } catch (\Exception $e) {
             return handleError($e, $this);
         }