我有这样的路由API代码

Route::group(['middleware' => 'auth:api','web'], function(){
    Route::get('user', 'Api\AuthController@user');
    Route::get('kurir', 'Api\AuthController@kurir');
    Route::get('droppoint', 'Api\DroppointController@index');
    Route::get('droppoint/{id}', 'Api\DroppointController@show');
    Route::post('droppoint', 'Api\DroppointController@store');
    Route::put('droppoint/{id}', 'Api\DroppointController@update');
    Route::delete('droppoint/{id}', 'Api\DroppointController@destroy');
});

Route::group(['middleware' => 'auth:kurirs-api','web'], function(){
    Route::get('user', 'Api\AuthController@user');
    Route::get('kurir', 'Api\AuthController@kurir');
    Route::get('droppoint', 'Api\DroppointController@index');
    Route::get('droppoint/{id}', 'Api\DroppointController@show');
    Route::post('droppoint', 'Api\DroppointController@store');
    Route::put('droppoint/{id}', 'Api\DroppointController@update');
    Route::delete('droppoint/{id}', 'Api\DroppointController@destroy');
});

我想使登录程序与两个角色“用户”和“库里尔”。
我的问题是为什么它只授权最后一个“kurirs-api”，如果我访问第一个它显示未认证？如果我改变位置，它只授权“auth：api”.怎么做才能使代码可以授权“api”和“kurirs-api”？
我已经在网上搜索了，但问题仍然没有解决