Inertia, a separate SPA or Livewire
Inertia when one team owns everything
Inertia lets Laravel keep doing routing, controllers, middleware and authorization while pages are written as React or Vue components. A controller returns a component name and its props instead of a Blade view. There is no REST API to design, document and version, and no client-side router to keep in step with the server. For a web product with a single front end and a single team this is the cheapest architecture to build and to own. Its limit is equally clear: the props are not a public API. If a mobile app or partners need the same data, you add proper endpoints for them.
A separate SPA when there are several consumers
A standalone React or Vue application with a Laravel API makes sense when the API is needed anyway, for mobile apps or integrations, or when front-end and back-end teams ship on different schedules. You pay for the independence. Routing exists twice, validation messages must travel through the API in a consistent format, and deployments have to be coordinated so a new front end never calls an endpoint that is not live yet. We agree the contract as an OpenAPI document first, as described under Laravel API development, and generate TypeScript types from it so mismatches fail at build time.
Livewire when you do not need a SPA at all
Many applications want interactivity without a JavaScript framework. Livewire components are PHP classes with Blade templates that update over small network requests. Searchable tables, multi-step forms, modals and inline edits are well within reach, and the team stays in one language. It is less suited to interfaces with heavy client-side state, such as a design canvas or a spreadsheet-like editor, or to screens that must work offline. We often recommend it for back-office software.
Authentication without the usual mistakes
If the front end is served from the same site as Laravel, use the session cookie. Sanctum supports this for SPAs, the cookie is HTTP-only, and CSRF protection works as normal. Tokens in browser storage are exposed to any script that runs on the page, so we reserve tokens for mobile and third-party clients. The UI also needs to know what the user may do. We pass a compact list of abilities derived from Laravel policies, so buttons are hidden for the right people while the server remains the real gatekeeper.
Rendering, forms and server state
Public pages that need to rank get server-side rendering. Inertia has an SSR mode that runs a small Node process beside PHP, and a decoupled build can use Next or Nuxt. Logged-in screens rarely need it. Forms submit to Laravel form requests, and validation errors map straight back to fields. For server data in a standalone SPA we use a query library that caches and refetches, and keep client stores for true interface state only, such as which panel is open.