How can I properly invalidate JWT tokens on logout in Laravel?

I'm having trouble with the logout function in my AuthController. Registering and logging in work perfectly, and I can even refresh tokens, but the logout endpoint does not seem to invalidate the JWT token properly. Even after logout, I can still access protected routes.

Below is the relevant code:

Register a New User (Works)
This function registers a user with role-based access control.

PHPCopied
public function register(Request $request)
{
    $request->validate([
        'name' => 'required|string|max:255',
        'email' => 'required|string|email|unique:users',
        'password' => 'required|string|min:6',
        'role' => 'required|in:admin,superadmin,faculty'
    ]);

    $user = User::create([
        'name' => $request->name,
        'email' => $request->email,
        'password' => Hash::make($request->password),
        'role' => $request->role
    ]);

    return response()->json(['message' => 'User registered successfully'], 201);
}

Login User and Generate Token (Works)
This function logs in the user and generates a JWT token for authentication.

PHPCopied
public function login(Request $request)
{
    $credentials = $request->only('email', 'password');

    if (!$token = Auth::attempt($credentials)) {
        return response()->json(['error' => 'Unauthorized'], 401);
    }

    // Log the login event
    AuthLog::create([
        'user_id' => Auth::id(),
        'action' => 'login',
        'ip_address' => $request->ip(),
        'user_agent' => $request->header('User-Agent')
    ]);

    return $this->respondWithToken($token);
}

Logout User (Issue Here)
The logout function is intended to invalidate the token, yet it doesn't seem to work as expected.

PHPCopied
public function logout(Request $request)
{
    if (!$request->user()) {
        return response()->json(['error' => 'Unauthorized'], 401);
    }

    // Log the logout event
    AuthLog::create([
        'user_id' => Auth::id(),
        'action' => 'logout',
        'ip_address' => $request->ip(),
        'user_agent' => $request->header('User-Agent')
    ]);

    // Revoke all tokens for the authenticated user
    $request->user()->tokens()->delete();

    return response()->json(['message' => 'Logged out successfully'], 200);
}

Refresh Token (Works)

PHPCopied
public function refresh()
{
    return $this->respondWithToken(Auth::refresh());
}

protected function respondWithToken($token)
{
    return response()->json([
        'access_token' => $token,
        'token_type' => 'bearer',
        'expires_in' => Auth::factory()->getTTL() * 60,
        'user' => Auth::user()
    ]);
}

These are my API routes:

PHPCopied
Route::group(['prefix' => 'auth'], function () {
    Route::post('register', [AuthController::class, 'register']);
    Route::post('login', [AuthController::class, 'login']);
    Route::post('logout', [AuthController::class, 'logout'])->middleware('auth:api');
    Route::post('refresh', [AuthController::class, 'refresh']);
    Route::get('me', [AuthController::class, 'me'])->middleware('auth:api');
});

// Role-based dashboard access
Route::group(['middleware' => ['auth:api', 'role:admin']], function () {
    Route::get('/admin/dashboard', function () {
        return response()->json(['message' => 'Welcome Admin']);
    });
});

Route::group(['middleware' => ['auth:api', 'role:superadmin']], function () {
    Route::get('/superadmin/dashboard', function () {
        return response()->json(['message' => 'Welcome SuperAdmin']);
    });
});

Route::group(['middleware' => ['auth:api', 'role:faculty']], function () {
    Route::get('/faculty/dashboard', function () {
        return response()->json(['message' => 'Welcome Faculty']);
    });
});

Issue Summary:

• Register, login, and refresh routes work fine.
• Logging out does not invalidate the JWT token, allowing access to protected routes post logout.

My Suspicions and Questions:

• Is using $request->user()->tokens()->delete() the correct approach for JWT tokens, or should I use Auth::logout() to properly invalidate the token?
• Is there any configuration in config/auth.php or config/jwt.php that I'm missing?

What I Need Help With:
How can I properly invalidate JWT tokens on logout? Should I use Auth::logout() (or JWTAuth::invalidate() if using that package) instead of deleting tokens from the database?