Locale & timezone

'locale' => [
    'header' => 'X-Locale',
    'supported' => ['en', 'sk'],         // list<string>|null → [app.locale]
    'store_on_registration' => true,
    'fill_on_login' => true,
    'timezone' => true,
],

• Negotiation — the guard’s X-Locale header wins when it names a supported locale; then Accept-Language (q-values, *, bounded to 20 entries and 1 KB), matched exactly, then by language prefix (sk-SK → sk).
• Storage — locale and timezone are stored on registration and invitation acceptance, filled on login when empty, and changed with PATCH locale; LocaleUpdated fires.
• Notifications — preferredLocale() makes Laravel localise account mail; mail to other addresses (the new or old address, an invitee) carries an explicit locale.
• Timezone — display-only (e.g. the new-device notification’s time); stored times follow the app timezone.

PATCH /users/auth/locale
Authorization: Bearer eyJ…

{ "locale": "sk", "timezone": "Europe/Bratislava" }

The authentication.locale middleware applies the account’s locale on your own routes, else the negotiated one:

Route::middleware(['auth:users', 'authentication.guard:users', 'authentication.locale'])
    ->group(fn () => Route::get('/dashboard', Dashboard::class));