🛠 Build and Secure a Laravel API
Tags: laravel, security
Published: 2021-05-18 20:34:20

### 📕 In this tutorial, you'll learn how to create a simple Laravel API and add authorization to it using Auth0. You can find the final code in this GitHub repository.

### <br>
## Getting Started

In this tutorial, you'll learn how to create a simple Laravel API and add authorization to it using [Auth0](https://auth0.com). You can find the final code in this [GitHub repository](https://github.com/auth0-blog/laravel-api-auth).

> 👋 If you already have a Laravel API that you want to secure, you can go ahead and skip to the ["Secure your Laravel API" section](#Secure-your-Laravel-API).

### Prerequisites

This tutorial uses the latest version of Laravel at the time of writing (`v8`). I will assume you have some basic knowledge of Laravel. If you're new to Laravel, [Build a Laravel CRUD Application with Authentication](https://auth0.com/blog/build-a-laravel-6-app-with-authentication/) may be a better primer for you!

You'll also need the following:

- [Composer](https://getcomposer.org/)
- PHP >= `7.3`
- A [free Auth0 account](https://auth0.com/signup)

### What you'll build

You'll be building a simple API with a single `/comment` resource. The API should allow **anyone** to view comments. However, **only authorized users** should be able to create, update, or delete a comment.

**Public endpoints:**

- `GET /comments` &mdash; Return all comments
- `GET /comments/{id}` &mdash; Return the comment with the specified `id`

**Private endpoints:**

- `POST /comments` &mdash; Add a new comment
- `PUT /comments/{id}` &mdash; Update the comment with the specified `id`
- `DELETE /comments/{id}` &mdash; Delete the comment with the specified `id`

## Setting Up Your Laravel Application

### Installation

First, start by creating your new Laravel application. Make sure you have [Composer](https://getcomposer.org/) installed, and then run the following:

```bash
composer create-project laravel/laravel laravel-api-auth
cd laravel-api-auth
php artisan serve
```

You can now view your starter Laravel application at [http://localhost:8000](http://localhost:8000)!

![Laravel starter app](https://images.ctfassets.net/23aumh6u8s0i/2fZ2LNHDCQEb1xcLNzzIyC/8eb2861df002204c3893b0b33db392ab/01_laravel-starter-app.jpg)

> 👩‍💻 Tip: There are several other options for [starting a new Laravel project](https://laravel.com/docs/8.x/installation#your-first-laravel-project). You can now even run your Laravel project with Docker using the brand new [Laravel Sail](https://laravel.com/docs/8.x/sail).

### Sign up for Auth0

Next, you need to <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a> if you don't already have one.

Your free account allows you to easily add authentication and authorization to your applications. You'll also have access to:

- 7,000 free active users and unlimited logins
- [Auth0 Universal Login](https://auth0.com/universal-login) for Web, iOS & Android
- Up to 2 [social identity providers](https://auth0.com/docs/identityproviders) like Google, GitHub, and Twitter
- Unlimited [Serverless Rules](https://auth0.com/docs/rules/current) to customize and extend Auth0's capabilities

You'll go through a short sign-up process where you'll [create your Auth0 tenant](https://auth0.com/docs/get-started/learn-the-basics#account-and-tenants). Once you've finished, leave the dashboard open, as you'll be revisiting it soon.


[Read more...](https://auth0.com/blog/build-and-secure-laravel-api/?utm_source=content_synd&utm_medium=sc&utm_campaign=laravel)