[riesjart]

Authenticate::using('sanctum') resolves to Illuminate\Auth\Middleware\Authenticate:sanctum rather than auth:sanctum, so routes using it got no 401 response and no security requirement.

ErrorResponsesExtension already accepts Authorize::class.':' next to can:. This does the same for Authenticate, in both the error response extension and the default patterns of MiddlewareAuthSecurityStrategy.

Route::get('posts', [PostController::class, 'index'])
    ->middleware(Authenticate::using('sanctum'));