I experienced something like this in Laravel 12.
My issue was solved by where i placed the middleware.
This did not work with CSFR issued tokens, but it worked with normal api tokens issued by sanctum.

Route::middleware(['auth:sanctum'])->group(function () {
    //Routes
});

I moved the middleware definition and that fixed the problem.

Route::group(function () {
    //Routes
})->middleware(['auth:sanctum']);