<p>Short answer: yes I have, I used OAuth 2 and I would absolutely do it again.</p>

<p>I wrote up my experience in general terms <a href="https://angell.io/blog/what-i-learned-creating-an-api-in-craft" rel="noreferrer">here</a> but essentially it boiled down to two plugins, one on each site: one acting as the server and another as the client.</p>

<p>I used <a href="http://oauth2.thephpleague.com/" rel="noreferrer"><code>league/oauth2-server</code></a> for the server and then tied in directly to the <a href="https://dukt.net/oauth" rel="noreferrer">Dukt OAuth plugin</a> for the client, but in retrospect it would’ve been simpler just using <a href="https://github.com/thephpleague/oauth2-client" rel="noreferrer"><code>league/oauth2-client</code></a> for that.</p>

<p>For transforming data like the Element API does I used <a href="http://fractal.thephpleague.com/" rel="noreferrer"><code>league/fractal</code></a> and then to get proper request behaviour I used <a href="https://github.com/zendframework/zend-diactoros" rel="noreferrer"><code>zendframework/zend-diactoros</code></a>.</p>

<p>Essentially I think this sort of thing is perfectly feasible in Craft, due to plugins being so flexible you can load whatever libraries you need and go nuts. Craft 3 could simplified things somewhat with <a href="http://www.yiiframework.com/doc-2.0/guide-structure-modules.html" rel="noreferrer">Yii Modules</a> as I’m guessing you could package up the whole API code as a module, but it shouldn’t be necessary.</p>

<p>Hope that helps!</p>

CC BY-SA 3.0
2017-05-31T15:35:59.507Z
That’s great – thanks! I’ve been looking at the league/oauth2-server package so it’s a relief to hear that you had success using that with Craft. It sounds as though ‘Craft all the things’ is the way to go.
Dom Stubbs
CC BY-SA 3.0
2017-05-31T17:35:14.820Z
@DomStubbs ha, yes I'm a massive advocate of that approach!
Josh Angell
CC BY-SA 3.0
2017-05-31T15:01:09.800Z
2017-05-31T15:01:09.800Z
Josh Angell
<p>I’m currently considering options for a project that will require a standard sales site, commerce features and a user database. The user database will require a web frontend and an API for communication with a mobile app (read and write).</p>

<p>My dilemma is whether it makes sense to consider Craft for all three components, which will give us all the benefits of a unified system, or to split the user database into a separate project where we could take advantage of something like Laravel Passport, which seems like the obvious option for efficiently building a secure API.</p>

<p>The <a href="https://github.com/airtype/craft-httpmessages" rel="noreferrer">HTTP Messages</a> plugin looks useful but doesn’t appear to deal with authentication at all and preexisting options for Yii/Craft OAuth appear limited to nonexistent. I get the sense that Craft 3/Yii 2 would make life easier, but waiting for a stable Craft 3 release isn’t possible.</p>

<p>Has anyone had any experience developing a secured API on top of Craft? If so, what route did you take and would you do it again?</p>

<plugin-development>
Adding a RESTful, OAuth API on top of Craft
# Adding a RESTful, OAuth API on top of Craft

(Asked by: username_0 on 2017-05-31)

I’m currently considering options for a project that will require a standard sales site, commerce features and a user database. The user database will require a web frontend and an API for communication with a mobile app (read and write).

My dilemma is whether it makes sense to consider Craft for all three components, which will give us all the benefits of a unified system, or to split the user database into a separate project where we could take advantage of something like Laravel Passport, which seems like the obvious option for efficiently building a secure API.

The [HTTP Messages](https://github.com/airtype/craft-httpmessages) plugin looks useful but doesn’t appear to deal with authentication at all and preexisting options for Yii/Craft OAuth appear limited to nonexistent. I get the sense that Craft 3/Yii 2 would make life easier, but waiting for a stable Craft 3 release isn’t possible.

Has anyone had any experience developing a secured API on top of Craft? If so, what route did you take and would you do it again?

**Tags:** plugin-development


---

## 1 answers

### Answer by username_1 on 2017-05-31. Score: 8 | Accepted answer

Short answer: yes I have, I used OAuth 2 and I would absolutely do it again.

I wrote up my experience in general terms [here](https://angell.io/blog/what-i-learned-creating-an-api-in-craft) but essentially it boiled down to two plugins, one on each site: one acting as the server and another as the client.

I used [`league/oauth2-server`](http://oauth2.thephpleague.com/) for the server and then tied in directly to the [Dukt OAuth plugin](https://dukt.net/oauth) for the client, but in retrospect it would’ve been simpler just using [`league/oauth2-client`](https://github.com/thephpleague/oauth2-client) for that.

For transforming data like the Element API does I used [`league/fractal`](http://fractal.thephpleague.com/) and then to get proper request behaviour I used [`zendframework/zend-diactoros`](https://github.com/zendframework/zend-diactoros).

Essentially I think this sort of thing is perfectly feasible in Craft, due to plugins being so flexible you can load whatever libraries you need and go nuts. Craft 3 could simplified things somewhat with [Yii Modules](http://www.yiiframework.com/doc-2.0/guide-structure-modules.html) as I’m guessing you could package up the whole API code as a module, but it shouldn’t be necessary.

Hope that helps!

> **Comments:**
> **username_0**: That’s great – thanks! I’ve been looking at the league/oauth2-server package so it’s a relief to hear that you had success using that with Craft. It sounds as though ‘Craft all the things’ is the way to go.  
> **username_1**: @DomStubbs ha, yes I'm a massive advocate of that approach!  

---

