1. Laravel as the system of record

Keep domain logic, authorization policies, validation, and side effects in Laravel. Expose a clear HTTP surface: REST or JSON:API style resources, predictable error shapes, and idempotent actions where it matters. The front end should not be the only place that enforces “you cannot delete a paid subscription”—Laravel must.

For internal operators, Filament or Nova (or a thin Blade admin) lives here too, sharing the same models and policies as the API. That avoids a parallel “shadow CRM” built only in the SPA.

2. Next.js when the web is the product surface

Choose Next.js when you need SSR, SSG, or hybrid rendering for SEO, fast first paint, or route-level data loading that should not dump secrets into the browser. The App Router plays well with a Laravel API: server components or route handlers can call Laravel with server-only credentials; the client hydrates for interactivity.

If the app is mostly authenticated dashboard with little SEO benefit, Laravel + Inertia + React is often simpler—one deploy, session auth for first-party users, and fewer CORS and token stories to operate.

3. Auth: pick one story per audience

For first-party web apps, session cookies (Sanctum with SPA or same-site setup, or classic web guard) reduce token leakage and refresh complexity. For mobile or third-party consumers, OAuth2 / personal access tokens via Laravel Passport or Sanctum’s token abilities stay explicit.

Mixing “sometimes cookie, sometimes Bearer” across the same routes without documentation is how on-call pages happen—name the client type (browser Next app, mobile, partner) and align middleware to it.

4. Deployment and environments

Run Laravel and Next as separate services when teams and release cadences differ; use a reverse proxy or edge rules so users see one origin. For smaller products, a single platform (e.g. Laravel Forge + a Node process, or Docker Compose) can still keep build and migrate steps explicit in CI.

5. What I avoid

  • Duplicating validation and business rules only in React—always mirror critical rules server-side.
  • Leaking Laravel .env secrets into NEXT_PUBLIC_* variables.
  • Adding Next.js for marketing when a static site or Blade would ship in a week with lower ops cost.

React, Next.js, and Laravel together are not a religion—they are a split of concerns that works when the API contract and auth model are boring enough that the team spends time on product, not glue code.