Answers.Body: <p>Short answer: yes I have, I used OAuth 2 and I would absolutely do it again.</p>
  
  <p>I wrote up my experience in general terms <a href="https://angell.io/blog/what-i-learned-creating-an-api-in-craft" rel="noreferrer">here</a> but essentially it boiled down to two plugins, one on each site: one acting as the server and another as the client.</p>
  
  <p>I used <a href="http://oauth2.thephpleague.com/" rel="noreferrer"><code>league/oauth2-server</code></a> for the server and then tied in directly to the <a href="https://dukt.net/oauth" rel="noreferrer">Dukt OAuth plugin</a> for the client, but in retrospect it would’ve been simpler just using <a href="https://github.com/thephpleague/oauth2-client" rel="noreferrer"><code>league/oauth2-client</code></a> for that.</p>
  
  <p>For transforming data like the Element API does I used <a href="http://fractal.thephpleague.com/" rel="noreferrer"><code>league/fractal</code></a> and then to get proper request behaviour I used <a href="https://github.com/zendframework/zend-diactoros" rel="noreferrer"><code>zendframework/zend-diactoros</code></a>.</p>
  
  <p>Essentially I think this sort of thing is perfectly feasible in Craft, due to plugins being so flexible you can load whatever libraries you need and go nuts. Craft 3 could simplified things somewhat with <a href="http://www.yiiframework.com/doc-2.0/guide-structure-modules.html" rel="noreferrer">Yii Modules</a> as I’m guessing you could package up the whole API code as a module, but it shouldn’t be necessary.</p>
  
  <p>Hope that helps!</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-31T15:35:59.507Z
Answers.Text: That’s great – thanks! I’ve been looking at the league/oauth2-server package so it’s a relief to hear that you had success using that with Craft. It sounds as though ‘Craft all the things’ is the way to go.
Answers.UserDisplayName: Dom Stubbs
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-31T17:35:14.820Z
Answers.Text: @DomStubbs ha, yes I'm a massive advocate of that approach!
Answers.UserDisplayName: Josh Angell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-31T15:01:09.800Z
Answers.LastActivityDate: 2017-05-31T15:01:09.800Z
Answers.UserDisplayName: Josh Angell
Body: <p>I’m currently considering options for a project that will require a standard sales site, commerce features and a user database. The user database will require a web frontend and an API for communication with a mobile app (read and write).</p>
  
  <p>My dilemma is whether it makes sense to consider Craft for all three components, which will give us all the benefits of a unified system, or to split the user database into a separate project where we could take advantage of something like Laravel Passport, which seems like the obvious option for efficiently building a secure API.</p>
  
  <p>The <a href="https://github.com/airtype/craft-httpmessages" rel="noreferrer">HTTP Messages</a> plugin looks useful but doesn’t appear to deal with authentication at all and preexisting options for Yii/Craft OAuth appear limited to nonexistent. I get the sense that Craft 3/Yii 2 would make life easier, but waiting for a stable Craft 3 release isn’t possible.</p>
  
  <p>Has anyone had any experience developing a secured API on top of Craft? If so, what route did you take and would you do it again?</p>
  
Tags: <plugin-development>
Title: Adding a RESTful, OAuth API on top of Craft
ThreadText: # Adding a RESTful, OAuth API on top of Craft
  
  (Asked by: username_0 on 2017-05-31)
  
  I’m currently considering options for a project that will require a standard sales site, commerce features and a user database. The user database will require a web frontend and an API for communication with a mobile app (read and write).
  
  My dilemma is whether it makes sense to consider Craft for all three components, which will give us all the benefits of a unified system, or to split the user database into a separate project where we could take advantage of something like Laravel Passport, which seems like the obvious option for efficiently building a secure API.
  
  The [HTTP Messages](https://github.com/airtype/craft-httpmessages) plugin looks useful but doesn’t appear to deal with authentication at all and preexisting options for Yii/Craft OAuth appear limited to nonexistent. I get the sense that Craft 3/Yii 2 would make life easier, but waiting for a stable Craft 3 release isn’t possible.
  
  Has anyone had any experience developing a secured API on top of Craft? If so, what route did you take and would you do it again?
  
  **Tags:** plugin-development
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-05-31. Score: 8 | Accepted answer
  
  Short answer: yes I have, I used OAuth 2 and I would absolutely do it again.
  
  I wrote up my experience in general terms [here](https://username_1.io/blog/what-i-learned-creating-an-api-in-craft) but essentially it boiled down to two plugins, one on each site: one acting as the server and another as the client.
  
  I used [`league/oauth2-server`](http://oauth2.thephpleague.com/) for the server and then tied in directly to the [Dukt OAuth plugin](https://dukt.net/oauth) for the client, but in retrospect it would’ve been simpler just using [`league/oauth2-client`](https://github.com/thephpleague/oauth2-client) for that.
  
  For transforming data like the Element API does I used [`league/fractal`](http://fractal.thephpleague.com/) and then to get proper request behaviour I used [`zendframework/zend-diactoros`](https://github.com/zendframework/zend-diactoros).
  
  Essentially I think this sort of thing is perfectly feasible in Craft, due to plugins being so flexible you can load whatever libraries you need and go nuts. Craft 3 could simplified things somewhat with [Yii Modules](http://www.yiiframework.com/doc-2.0/guide-structure-modules.html) as I’m guessing you could package up the whole API code as a module, but it shouldn’t be necessary.
  
  Hope that helps!
  
  > **Comments:**
  > **username_0**: That’s great – thanks! I’ve been looking at the league/oauth2-server package so it’s a relief to hear that you had success using that with Craft. It sounds as though ‘Craft all the things’ is the way to go.  
  > **username_1**: @username_0 ha, yes I'm a massive advocate of that approach!  
  
  ---
  
  