Building a Secure REST API with Laravel

A step-by-step guide to designing and building a robust, secure RESTful API with Laravel and Sanctum, from routing to rate limiting.

Building a robust RESTful API with Laravel means following best practices from the very start. ## Initial setup Install Laravel Sanctum for authentication: ```bash php artisan install:api ``` ## Route structure Organize your routes in `routes/api.php`: ```php Route::prefix('v1')->group(function () { Route::apiResource('posts', PostController::class); Route::apiResource('comments', CommentController::class); }); ``` ## API Resources Transform your models into consistent JSON responses: ```php class PostResource extends JsonResource { public function toArray($request): array { return [ 'id' => $this->id, 'title' => $this->title, 'author' => new UserResource($this->author), 'created_at' => $this->created_at->toIso8601String(), ]; } } ``` ## Request validation Use Form Requests to validate incoming data: ```php class StorePostRequest extends FormRequest { public function rules(): array { return [ 'title' => 'required|string|max:255', 'content' => 'required|string', 'tags' => 'array', ]; } } ``` ## Error handling Centralize your error handling: ```php public function render($request, Throwable $e) { if ($request->expectsJson()) { return response()->json([ 'message' => $e->getMessage(), ], $this->getStatusCode($e)); } } ``` ## Rate Limiting Protect your API against abuse: ```php RateLimiter::for('api', function (Request $request) { return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip()); }); ``` ## Documentation Document your API with OpenAPI/Swagger to make it easier to use.