How should I make sure the user accessing a backend rendered frontend route is authenticated?

I'm using Laravel and Angular to write a web app.

In the front end Laravel is used to create the basic template, but otherwise controlled by Angular. In the back end laravel is used to create a restful API.

I have a few routes like this:

Route::group(['domain' => 'domain.com'], function() {

    Route::get('/', ['as' => 'home', function () {
        return view('homepage');
    }]);

    Route::get('/login', ['as' => 'login', function () {
        return view('login');
    }]);

    //users should be authenticated before accessing this page
    Route::get('/dashboard', ['as' => 'dashboard', function () {
        return view('dashboard');
    }]); 

});

Route::group(['domain' => 'api.domain.com', 'middleware' => ['oauth']], function() {
    Route::post('/post/create', ['uses' => 'PostController@store']);
    Route::get('/post/{id}', ['uses' => 'PostController@show']);

     //other API endpoints
     // ...
});

I want to make sure my domain.com/dashboard URL is only accessed by authenticated users.

In my backend I have OAuth implemented for my API routes which makes sure the user accessing those routes are authentic. Laravel's Auth::once() is used by the OAuth library to make sure the user credentials are correct then generates an access_token. Since Auth::once() is a "stateless" function no session or cookies are utilized and I cannot use Auth::check() to make sure a user is authenticated before the dashboard page is rendered.

How should I go about checking to see if the user trying to access domain.com/dashboard is authenticated? Should I send the access_token in the header when I forward the user from /login to /dashboard? Or should I implement Laravel's a session/cookie based authentication?

EDIT: As per this: Adding http headers to window.location.href in Angular app I cannot forward the user to the dashboard page with an Authorization header.

In order to reuse my API for my mobile apps I STRONGLY prefer to use some sort of token based authentication.