title: Use sessions in laravel APIs
body: <p>To create a Two-factor SMS verification in larvel 5.5 and via <a href="https://github.com/dingo/api" rel="noreferrer">dingo</a> package, I follow this Simplified workflow:</p>
  
  <p>First check isTwoFactorActive is true or false in your login function if its true send SMS and give the response to get SMS code which is received. If its false directly return token.</p>
  
  <pre><code>Route::post('auth/login', function () {
  
      $credentials = Input::only('email', 'password');
  
      if ( ! $token = JWTAuth::attempt($credentials) )
      {
          // return the 401 response
          return Response::json(['error' =&gt; 'invalid_credentials'], 401);
      } 
  
      if(Auth::user()-&gt;isTwoFactorActive) {
  
      $code = rand(1000,9999);  //generate sms code
  
      $send_sms = SendSMS($code,Auth::user()-&gt;phone);  //write your own code here to send SMS to user mobile
  
      $data= collect(array('sms_code'=&gt;$code,'token'=&gt;$token));  // save sms_code and token in an array 
  
      Session::push(Auth::user()-&gt;id, $data); // save array into session.
  
      return Response::json(array('login_status'=&gt;'success','user_id'=&gt;Auth::user()-&gt;id,'sms_required'=&gt;'yes'));
  
      } else {
  
      return Response::json(array('login_status'=&gt;'success','token'=&gt;$token));
  
      }
  });
  </code></pre>
  
  <p>Now on front end check the response if the token present, then go ahead and show homepage or show enter SMS code screen and capture the SMS code in a form and then post the details to this API again.</p>
  
  <pre><code>Route::post('sms/verification', function () {
  
      $user_id = Request::input('user_id');
      $code= Request::input('code');
  
      $data = Session::get($user_id);
  
      if($data-&gt;sms_code == $code) {
  
      return Response::json(array('status'=&gt;'success','token'=&gt;$data-&gt;token));
  
      } else {
  
     return Response::json(array('status'=&gt;'failed','msg'=&gt;'Invalid sms code!'));
  
     }
  });
  </code></pre>
  
  <p>As you can see I used session to store created token to send it after successful two-factor authorization. But seem we can not use session in laravel  and APIs.</p>
  
  <p>what can I do in this case? </p>