Conception, separate Laravel Passport in resource and authorization server

Ok, i've a small question of application conception. I want to distinct the ressource and the authorization server with laravel passport.

I've an OAuth2 server and a classic laravel app with stateless authentification system homemade. I've an SPA with Vue.js which send login request to an REST interface to the front laravel app. This app called GuzzleClient to send an oauth password grant-type request to get a token.

    public function login(Request $request, Client $client)
    {
        $url = config('app.auth.server') .'/oauth/token';
        $response = $client->post($url, [
            'form_params' => [
                'grant_type' => 'password',
                'username' => $request->name,
                'password' => $request->password,
                'client_id' => config('auth.oauth.password.client-id'),
                'client_secret' => config('auth.oauth.password.client-secret'),
            ]
        ]);

        if ($response->getStatusCode() !== Response::HTTP_OK) {
            return http_response_code($response->getStatusCode());
        }

        return response()->json($response->getBody()->getContent(), Response::HTTP_OK);
    }

But, if i want to protect an API route, i cannot use the auth:api guard provided by passport.

2 solutions.

• Create middleware in front app which call a custom route created in authorization server (laravel passport) to send bearer access_token (sent from javascript) and verify it's validity by the OAuth server.
• Get the secret key used by passport for jwt and let the resource server verify itself the token validity. (using custom guard)

The second solution is probably better. But what do you think ? Do you have any idea or best practices ?

Thx for reading.