Laravel cannot protect API routes

I have the following route in my routes/api.php:

Route::group(['middleware' => ['auth']], function () {
    Route::get('users/', 'Api\UserController@index');
});

This constantly redirects me to my dashboard.

Then I try this:

 Route::get('users/', 'Api\UserController@index')->middleware('auth');

This works but it doesn't not protect the route, so I can still access it if I am logged out.

Any Ideas why this is? I'm not sure what the best way is to authenticate API routes, what it the usual convention?

I am using Laravel 5.5

from Newest questions tagged laravel-5 - Stack Overflow http://ift.tt/2mRaN10
via IFTTT