Build Secure PHP REST API in Laravel 8 with Sanctum Auth

In this tutorial you will learn about the Build Secure PHP REST API in Laravel 8 with Sanctum Auth and its application with practical example.

In this Build Secure PHP REST API in Laravel 8 with Sanctum Auth Tutorial I will show you how to create REST API with Sanctum authentication In laravel. In this tutorial you will learn to create rest api with Sanctum authentication In laravel 8 application. In this article I will share example to create simple crud rest api with sanctum authentication in laravel. I will also show you how to install sanctum auth package in laravel. After installing and configure sanctum authentication in laravel we will create simple crud operation rest api.

Table Of Contents−

Build Secure PHP REST API in Laravel 8 with Sanctum Auth

In this step by step tutorial I will guide you through create a fully functional restful API with sanctum authentication in Laravel 8. We will be creating fully functional REST API along with sanctum Authentication. Please follow the instruction given below:

Step 1: Create Laravel Project
Step 2: Add Database Details

Step 3: Install Laravel Sanctum Pacakage
Step 4: Setting Up Sanctum
Step 5: Update Model and Run Migration

Step 6: Build API Resources
Step 7: Set Up Controllers
Step 8: Create REST API Routes

Step 09: Test REST API in Postman

Create Laravel Project

First of all we need to create a fresh laravel project, download and install Laravel 8 using the below command

composer create-project --prefer-dist laravel/laravel laravel-sanctum-auth

1	composer create-project --prefer-dist laravel/laravel laravel-sanctum-auth

Add Database Details in ENV

Now, lets create a MySQL database and connect it with laravel application. After creating database we need to set database credential in application’s .env file.

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=db_name
DB_USERNAME=root
DB_PASSWORD=

DB_CONNECTION=mysql

DB_HOST=127.0.0.1

DB_PORT=3306

DB_DATABASE=db_name

DB_USERNAME=root

DB_PASSWORD=

Install Laravel Sanctum Pacakage

In this step, we will install Sanctum Package via the composer dependency manager. Use the following command to install Sanctum Package.

composer require laravel/sanctum

1	composer require laravel/sanctum

Setting Up Sanctum

Now, we need to publish the Sanctum configuration and migration files using the Artisan command.

php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

1	php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"

Thereafter, register the sanctum middleware into the api array inside the app/Http/Kernel.php file

protected $middlewareGroups = [
...
...
    'api' => [
        \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
        'throttle:api',
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],
...
...
];

protected $middlewareGroups = [

...

'api' => [

\Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,

'throttle:api',

\Illuminate\Routing\Middleware\SubstituteBindings::class,

...

];

Now, run following command to migrate database schema along with sanctum tables in our database.

php artisan migrate

1	php artisan migrate

Lets Import the sanctum HasApiTokens service within the app/Models/User.php. Open App/User.php model file and add ‘Laravel\Sanctum\HasApiTokens’ trait in it.

<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;

// sanctum
use Laravel\Sanctum\HasApiTokens;


class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name',
        'email',
        'password',
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * The attributes that should be cast to native types.
     *
     * @var array
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];
}

<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;

use Illuminate\Database\Eloquent\Factories\HasFactory;

use Illuminate\Foundation\Auth\User as Authenticatable;

use Illuminate\Notifications\Notifiable;

// sanctum

use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable

{

use HasApiTokens, HasFactory, Notifiable;

/**

* The attributes that are mass assignable.

* @var array

protected $fillable = [

'name',

'email',

'password',

];

/**

* The attributes that should be hidden for arrays.

* @var array

protected $hidden = [

'password',

'remember_token',

];

/**

* The attributes that should be cast to native types.

* @var array

protected $casts = [

'email_verified_at' => 'datetime',

];

}

Update Model and Run Migration

Now, in this step we will create migration file. Please run the following command:

php artisan make:migration create_blogs_table

1	php artisan make:migration create_blogs_table

Open and add code into the database/migrations/create_blogs_table.php file. Add few properties into the migration file as following.

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

class CreateBlogsTable extends Migration
{
    /**
     * Run the migrations.
     *
     * @return void
     */
    public function up()
    {
        Schema::create('blogs', function (Blueprint $table) {
            $table->id();
            $table->string('title');
            $table->text('description');
            $table->timestamps();
        });
    }

    /**
     * Reverse the migrations.
     *
     * @return void
     */
    public function down()
    {
        Schema::dropIfExists('blogs');
    }
}

<?php

use Illuminate\Database\Migrations\Migration;

use Illuminate\Database\Schema\Blueprint;

use Illuminate\Support\Facades\Schema;

class CreateBlogsTable extends Migration

{

/**

* Run the migrations.

* @return void

public function up()

{

Schema::create('blogs', function (Blueprint $table) {

$table->id();

$table->string('title');

$table->text('description');

$table->timestamps();

});

}

/**

* Reverse the migrations.

* @return void

public function down()

{

Schema::dropIfExists('blogs');

}

Next, create an app/Models/Blog.php file and register product migration properties inside the $fillable array.

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;

class Blog extends Model
{
    use HasFactory;
    protected $fillable = [
        'title', 
        'description'
    ];    
}

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;

use Illuminate\Database\Eloquent\Model;

class Blog extends Model

{

use HasFactory;

protected $fillable = [

'title',

'description'

];

}

Now, run following command to migrate database schema.

php artisan migrate

1	php artisan migrate

<?php


namespace App\Http\Controllers\API;
use Illuminate\Http\Request;
use App\Http\Controllers\Controller as Controller;


class BaseController extends Controller
{
    /**
     * success response method.
     *
     * @return \Illuminate\Http\Response
     */
    public function sendResponse($result, $message)
    {
    	$response = [
            'success' => true,
            'data'    => $result,
            'message' => $message,
        ];

        return response()->json($response, 200);
    }


    /**
     * return error response.
     *
     * @return \Illuminate\Http\Response
     */
    public function sendError($error, $errorMessages = [], $code = 404)
    {
    	$response = [
            'success' => false,
            'message' => $error,
        ];

        if(!empty($errorMessages)){
            $response['data'] = $errorMessages;
        }

        return response()->json($response, $code);
    }
}

<?php

namespace App\Http\Controllers\API;

use Illuminate\Http\Request;

use App\Http\Controllers\Controller as Controller;

class BaseController extends Controller

{

/**

* success response method.

* @return \Illuminate\Http\Response

public function sendResponse($result, $message)

{

$response = [

'success' => true,

'data' => $result,

'message' => $message,

];

return response()->json($response, 200);

}

/**

* return error response.

* @return \Illuminate\Http\Response

public function sendError($error, $errorMessages = [], $code = 404)

{

$response = [

'success' => false,

'message' => $error,

];

if(!empty($errorMessages)){

$response['data'] = $errorMessages;

}

return response()->json($response, $code);

}

Open and place all the suggested code into the app/Http/Controllers/API/AuthController.php file.

<?php
   
namespace App\Http\Controllers\API;
   
use Illuminate\Http\Request;
use App\Http\Controllers\API\BaseController as BaseController;
use Illuminate\Support\Facades\Auth;
use Validator;
use App\Models\User;
   
class AuthController extends BaseController
{

    public function signin(Request $request)
    {
        if(Auth::attempt(['email' => $request->email, 'password' => $request->password])){ 
            $authUser = Auth::user(); 
            $success['token'] =  $authUser->createToken('MyAuthApp')->plainTextToken; 
            $success['name'] =  $authUser->name;
   
            return $this->sendResponse($success, 'User signed in');
        } 
        else{ 
            return $this->sendError('Unauthorised.', ['error'=>'Unauthorised']);
        } 
    }

    public function signup(Request $request)
    {
        $validator = Validator::make($request->all(), [
            'name' => 'required',
            'email' => 'required|email',
            'password' => 'required',
            'confirm_password' => 'required|same:password',
        ]);
   
        if($validator->fails()){
            return $this->sendError('Error validation', $validator->errors());       
        }
   
        $input = $request->all();
        $input['password'] = bcrypt($input['password']);
        $user = User::create($input);
        $success['token'] =  $user->createToken('MyAuthApp')->plainTextToken;
        $success['name'] =  $user->name;
   
        return $this->sendResponse($success, 'User created successfully.');
    }
   
}

<?php

namespace App\Http\Controllers\API;

use Illuminate\Http\Request;

use App\Http\Controllers\API\BaseController as BaseController;

use Illuminate\Support\Facades\Auth;

use Validator;

use App\Models\User;

class AuthController extends BaseController

{

public function signin(Request $request)

{

if(Auth::attempt(['email' => $request->email, 'password' => $request->password])){

$authUser = Auth::user();

$success['token'] = $authUser->createToken('MyAuthApp')->plainTextToken;

$success['name'] = $authUser->name;

return $this->sendResponse($success, 'User signed in');

}

else{

return $this->sendError('Unauthorised.', ['error'=>'Unauthorised']);

}

public function signup(Request $request)

{

$validator = Validator::make($request->all(), [

'name' => 'required',

'email' => 'required|email',

'password' => 'required',

'confirm_password' => 'required|same:password',

]);

if($validator->fails()){

return $this->sendError('Error validation', $validator->errors());

}

$input = $request->all();

$input['password'] = bcrypt($input['password']);

$user = User::create($input);

$success['token'] = $user->createToken('MyAuthApp')->plainTextToken;

$success['name'] = $user->name;

return $this->sendResponse($success, 'User created successfully.');

}

Now go to the app/Http/Controllers/API/BlogController.php file and insert the CRUD operations code into it:

<?php
   
namespace App\Http\Controllers\API;
   
use Illuminate\Http\Request;
use App\Http\Controllers\API\BaseController as BaseController;
use Validator;
use App\Models\Blog;
use App\Http\Resources\Blog as BlogResource;
   
class BlogController extends BaseController
{

    public function index()
    {
        $blogs = Blog::all();
        return $this->sendResponse(BlogResource::collection($blogs), 'Posts fetched.');
    }

    
    public function store(Request $request)
    {
        $input = $request->all();
        $validator = Validator::make($input, [
            'title' => 'required',
            'description' => 'required'
        ]);
        if($validator->fails()){
            return $this->sendError($validator->errors());       
        }
        $blog = Blog::create($input);
        return $this->sendResponse(new BlogResource($blog), 'Post created.');
    }

   
    public function show($id)
    {
        $blog = Blog::find($id);
        if (is_null($blog)) {
            return $this->sendError('Post does not exist.');
        }
        return $this->sendResponse(new BlogResource($blog), 'Post fetched.');
    }
    

    public function update(Request $request, Blog $blog)
    {
        $input = $request->all();

        $validator = Validator::make($input, [
            'title' => 'required',
            'description' => 'required'
        ]);

        if($validator->fails()){
            return $this->sendError($validator->errors());       
        }

        $blog->title = $input['title'];
        $blog->description = $input['description'];
        $blog->save();
        
        return $this->sendResponse(new BlogResource($blog), 'Post updated.');
    }
   
    public function destroy(Blog $blog)
    {
        $blog->delete();
        return $this->sendResponse([], 'Post deleted.');
    }
}

<?php

namespace App\Http\Controllers\API;

use Illuminate\Http\Request;

use App\Http\Controllers\API\BaseController as BaseController;

use Validator;

use App\Models\Blog;

use App\Http\Resources\Blog as BlogResource;

class BlogController extends BaseController

{

public function index()

{

$blogs = Blog::all();

return $this->sendResponse(BlogResource::collection($blogs), 'Posts fetched.');

}

public function store(Request $request)

{

$input = $request->all();

$validator = Validator::make($input, [

'title' => 'required',

'description' => 'required'

]);

if($validator->fails()){

return $this->sendError($validator->errors());

}

$blog = Blog::create($input);

return $this->sendResponse(new BlogResource($blog), 'Post created.');

}

public function show($id)

{

$blog = Blog::find($id);

if (is_null($blog)) {

return $this->sendError('Post does not exist.');

}

return $this->sendResponse(new BlogResource($blog), 'Post fetched.');

}

public function update(Request $request, Blog $blog)

{

$input = $request->all();

$validator = Validator::make($input, [

'title' => 'required',

'description' => 'required'

]);

if($validator->fails()){

return $this->sendError($validator->errors());

}

$blog->title = $input['title'];

$blog->description = $input['description'];

$blog->save();

return $this->sendResponse(new BlogResource($blog), 'Post updated.');

}

public function destroy(Blog $blog)

{

$blog->delete();

return $this->sendResponse([], 'Post deleted.');

}

Create REST API Routes

After this, we need to define routes in “routes/api.php” file. Lets open “routes/api.php” file and add the following routes in it.

routes/api.php

<?php
  
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
  
use App\Http\Controllers\API\AuthController;
use App\Http\Controllers\API\BlogController;
  
/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
*/
  
Route::post('login', [AuthController::class, 'signin']);
Route::post('register', [AuthController::class, 'signup']);
     
Route::middleware('auth:sanctum')->group( function () {
    Route::resource('blogs', BlogController::class);
});

<?php

use Illuminate\Http\Request;

use Illuminate\Support\Facades\Route;

use App\Http\Controllers\API\AuthController;

use App\Http\Controllers\API\BlogController;

|--------------------------------------------------------------------------

| API Routes

|--------------------------------------------------------------------------

Route::post('login', [AuthController::class, 'signin']);

Route::post('register', [AuthController::class, 'signup']);

Route::middleware('auth:sanctum')->group( function () {

Route::resource('blogs', BlogController::class);

});

Test Sanctum REST API in Postman

Now we are ready to run our example so lets start the development server using following artisan command –

php artisan serve

1	php artisan serve

Test Register REST API

http://localhost:8000/api/register

1	http://localhost:8000/api/register

http://localhost:8000/api/login

1	http://localhost:8000/api/login

Create Post with Sanctum API

http://localhost:8000/api/blogs

1	http://localhost:8000/api/blogs

Get Single Post

http://localhost:8000/api/blogs/{id}

1	http://localhost:8000/api/blogs/{id}

Fetch All Posts

http://localhost:8000/api/blogs

1	http://localhost:8000/api/blogs

Update Post

http://localhost:8000/api/blogs/{id}

1	http://localhost:8000/api/blogs/{id}

Delete Record

http://localhost:8000/api/blogs/{id}

1	http://localhost:8000/api/blogs/{id}

AngularJS

CodeIgniter

Laravel

Node Js

Wordpress

More Blog

Learn

ABOUT PAGES

Build Secure PHP REST API in Laravel 8 with Sanctum Auth