I'm building an app which requires user authentication.
(Till now I have always built monolithic apps. This is my first attempt at building a backend which is completely decoupled from the front end.)
The backend is a Laravel API and the frontend will be a React app in an independent repo.
Should I have used Laravel Passport instead of Laravel Breeze or are they supposed to be used together? I have never used the former.
Should I refactor my project and remove all Breeze code in order to use Passport instead?
Laravel Breeze isn't intended for use with APIs out of the box. That's not to say it can't be, there is a breeze-api package available which provides all the boilerplate authentication features provided by Breeze to work with APIs.
Passport is a full OAuth workflow authentication provider and quite possibly more hassle than you require if you're just looking to provide authentication for your first-party (your own) SPA or mobile application. If you don't require OAuth then Laravel Sanctum will more likely be a better option for you than Passport.
Remove Laravel Breeze and install Laravel Sanctum and Laravel Fortify.
If you're app is running on the same domain or on a subdomain Sanctum will use Laravel's web authentication guard (session-cookie based authentication).
If not Sanctum will look for a valid token in your authorization header.
Fortify will implement all of Laravel's authentication features. This way you got all your endpoints for login, registration, password reset, etc.. set. You can easily customize those methods and their responses.
You should use Laravel Sanctum for this. laravel breeze is basic auth feature