How I Structured My Laravel + React SaaS Starter Kit

Every SaaS project I take on starts with the same unglamorous week: authentication, user roles, a settings page, a dashboard shell, and arguing with myself about API response shapes. On my third client project I stopped copy-pasting from old repos and built the setup properly — once. This is how it's structured.

The split: API backend, SPA frontend

The reason is practical: sooner or later a dedicated frontend dev touches the project, and a clean API boundary makes that handoff painless.

Auth: Sanctum, kept boring

Laravel Sanctum with token-based auth. Login, register, logout, and a /me endpoint — the standard Sanctum token flow. Password reset and email verification aren't wired up yet (the User model has the MustVerifyEmail import stubbed and commented, ready for you to enable), so the auth surface stays small and honest. I chose Sanctum over Passport deliberately: for a typical SaaS the token flow is simpler and there's less machinery to maintain. The auth layer is isolated, so if you ever outgrow it, you're swapping one controller and a middleware, not rewiring the app.

On the React side, a single axios instance handles everything: base URL from env, an interceptor attaching the token, and a 401 interceptor that clears the session and redirects to login. Auth state lives in one context — components never touch tokens directly.

API conventions: one envelope, no guessing

Responses are plain, predictable Laravel JSON — auth returns the user resource plus the token, and validation errors use Laravel's standard shape keyed by field, which maps 1:1 onto frontend form validation. I kept the response shapes boring on purpose: no custom envelope to learn, no guessing what an endpoint returns.

Roles without the ceremony

A simple role column plus a middleware covers 90% of SaaS needs. The kit ships with admin and user roles and a seeder so you can log in as either immediately.

The React API layer

API access lives in one place — src/api/client.js, a single Axios instance with a token interceptor and a 401 interceptor that clears the session and redirects to login. Components and hooks go through this client; they never construct URLs or headers by hand. When an endpoint changes, you edit one file.

Billing-ready, not billing-forced

The structure anticipates subscriptions but Stripe isn't installed on day one. Add it when you have someone to charge.

I packaged all of this into a starter kit because I was tired of rebuilding it. If you'd rather skip week zero and start on your actual product, it's here:
Laravel + React SaaS Starter Kit — $19, one-time: https://kamranofficial.gumroad.com/l/mhekoig
Questions about any of the structural choices? Drop a comment — happy to dig in.