How to Separate Admin Panel and API Domains in a Multi-Tenant Laravel Nova App integrated by stancl/tenancy

[BehroozBvk]

Hi,

I'm using the following packages in my multi-tenant Laravel project:

• stancl/tenancy:^3.9.1
• laravel/nova:^5.0

I want to separate the domains used for the admin panel and for API access. Specifically:

• Admin panel should be accessible like this:

  https://tenant1.example.com
  https://tenant2.example.com
  

• API endpoints should be accessible through a different domain:

  https://tenant1.example-api.com/api/v1/user
  

And I want to make sure that the APIs are not accessible via the admin domain (example.com) and vice versa.

---

What I've tried so far:

I temporarily solved this requirement using the following approach, but it's not ideal — both domains (example.com and example-api.com) can still access each other’s routes, which violates my intended separation.

1. I defined both domains in the central_domains section of config/tenancy.php:

'central_domains' => [
    '127.0.0.1',
    'localhost',
    'example.com',
    'example-api.com',
],

2. I updated my config/nova.php middleware to:

'middleware' => [
    InitializeTenancyBySubdomain::class,
    PreventAccessFromCentralDomains::class,
    'web',
    \App\Http\Middleware\RedirectIfAuthenticated::class,
    \Laravel\Nova\Http\Middleware\HandleInertiaRequests::class,
    'nova:serving',
],

3. For API routes in routes/api.php:

Route::middleware([InitializeTenancyBySubdomain::class])->group(function () {
    Route::post('auth/token', [AuthController::class, 'token'])->name('auth.token');
});

---

Problem:

Despite this setup, both the admin panel and API are accessible from either domain (example.com and example-api.com). I want a strict separation between them.

---

Question:

How can I strictly isolate the admin panel (example.com) from the API routes (example-api.com) so that each domain only serves its intended purpose?

Any suggestions or recommended practices would be greatly appreciated.

Thanks!