Is it possible to create a second Laravel "api route" with a separate API KEY?

Question

I'm new to Laravel and I am handed an existing application that is composed of two parts:

1 - An admin backend built on Laravel and uses Vueify

2 - The frontend website built on next.js and uses react components

The admin part communicates with Laravel using the "web routes" but also uses the "api routes" as well since the vue components make AJAX requests using those "api routes".

I am now tasked with "connecting" the frontend part to the laravel app. The frontend part will be using AJAX as well to communicate with laravel but I was told I should not use the same "api route" that is used by the admin backend because that has a lot more privileges that should not be accessible by the frontend. Basically it's a security risk and that I should somehow separate the two.

I'm not actually sure which term to use.. I initially thought it was called "channel" but I see that channel is one of the 4 "ways" of connecting to laravel (the other 3 being web, api and console). So I think routes is the term to use and forgive me for the double-quotes.

I have made a simple diagram to show the structure I mean. What I need to know is is there a way to create a second api route that would be used exclusively by the frontend and would include only a limited set of priviledges. I imagine something like /frontapi/ or /webapi/ as opposed to /api/ which is used now by the backend.

Thanks a lot for your help and please correct me if I am using wrong terminology.

EDIT

Thank you all for answering the part regarding separating the route prefix and the api route files.

One part of the question that I realized late that I hadn't made clear was the importance of separating the API Keys for both APIs since I think that is the main security issue and what would really make then two individual API "Channels or ways". I think that is one reason why I was confusing about the terminology because "way" sounded to me more separate that just a "route". I've also edited the question to reflect that. Thank you again for taking the time to help.

The code that creates the api routes is in [`RouteServiceProvider`](https://github.com/laravel/laravel/blob/master/app/Providers/RouteServiceProvider.php#L73) which is in the laravel boilerplate. You could probably just replicate something similar in that file since that's code that should be living in your project anyway — apokryfos, Dec 23 '19 at 10:10

N69S · Answer 1 · 2019-12-25T07:20:28.883

4

You can decompose routes in as many files as you want, you can also give each file its own prefix (like how api.php routes start with /api)

The modification need to be done in App\Providers\RouteServiceProvider

//in map() add $this->mapApiTwoRoutes()
public function map()
{
    $this->mapApiRoutes();
    $this->mapApiTwoRoutes();//<---this one
    $this->mapWebRoutes();
}

//now add the method mapApiTwoRoutes
protected function mapApiTwoRoutes()
{
    Route::prefix('api2')//<-- prefix in the url
         ->middleware('api')//<-- api middleware (throttle and such check App\Http\Kernal.php)
         ->namespace('App\Http\Controllers') //<-- you can modify the namespace of the controllers 
         ->group(base_path('routes/apiTwo.php'));//<-- file containing the routes
}

And that's it.

edited Dec 25 '19 at 07:20

answered Dec 23 '19 at 10:14

N69S

16,110
3
22
36

Thanks for that! That sounds like it still uses the same API KEY though. I think the security concern was that the backend api has access to several privileged actions and separating that api from the front end api for that security reason means necessarily separating the api keys. I realize I wasn't descriptive on that part and I'm going to edit my question to focus on that. – frezq Dec 24 '19 at 13:13
Which api key is used depends on the middleware. You can specify the middleware for the routes but you'll need to customize it so it suits your requirements – N69S Dec 25 '19 at 07:23

score 0 · Answer 2 · answered Dec 23 '19 at 10:11

You need to define a new route file, firstly add a new entry $this->mapApi2Routes(); in the map() function in app\Providers\RouteServiceProvider.

Then add a new function in that file, basically copying the mapApiRoutes() function, call it mapApi2Routes(). You can use different middleware etc. for the new file.

The last step would be adding a new file api2.php in the routes folder.

Is it possible to create a second Laravel "api route" with a separate API KEY?

2 Answers2

Linked

Related