Consuming your web api on mobile

I hope this finds everybody well,

I am relatively new in the laravel community and for the past couple of months I have been building my final year computing project using laravel and so far it's been great ! Looking back, it is amazing what a journey has been and how many things I have learned from day 0 until now. Needless to say that a big part of this success has been thanks to the amazing tutorials on Laracasts and this community forum that has helped me with its vast discussion on common issues, but also on some more specific to my needs.

Back to the "Advice"... I have been researching different approaches on making my API available to mobile clients. Now I am not an expert, but I think so far, all the tutorials and threads I have found refer on using laravel in order to expose your API to third part applications.

My goal is to simply have two mobile applications and essentially "consume"my own api, given that the mobile client has authenticated via his username & passport, same thing that happens on the website.

I know many people would say, well that they could open the website on the browser and do their thing instead of having the website in an app, but nonetheless, I'd like to go that way for two reasons :

I need to implement this as part of my final year project.
It is always good to expose yourself to new things, get outside your comfort zone, learn and expand my skill set.

I hope that his sums it up, thanks for taking the time to read this and I am looking forward in suggestions on how would you go about creating this.

Thanks

bobbybouwmann

6 years ago

Level 88

If you're making an app that runs your website inside a browser, you don't have to do anything. This will have the same approach as a normal website.

If you want to consume the API in your app, you need an extra layer of authentication. The normal username/password login won't work anymore since the app can't handle the session. It's recommended to use API tokens to keep your API secure. Laravel Passport is a perfect fit for this. An alternative is Laravel Sanctum which is a little bit easier to handle than Laravel Passport.

teos_97

6 years ago

Level 9

@bobbybouwmann I see but, then assuming that a user downloads the app and registers, the new user is created, how would I share the access token? Is there a passport method for this ? or Do make a request from the register controller to my api route to generate a token ?

Atef95

6 years ago

Level 5

@teos_97 HTTP calls are stateless...

there is no sessions to keep the user authenticated

in this case when the user login your app he will get a token from the back end..

this token will be send back again in any future request to ensure user is authorized to access the data..

Read about Laravel Passport it will handle all of that...

that's it...

bobbybouwmann

6 years ago

Best Answer

Level 88

Like @atef95 says, HTTP calls are stateless. You need to send the token along to know which user you're dealing with.

You need a login route that returns the access token for the user. Ideally, you also want to have a refresh token, if the previous token got expired. There are different kinds of tokens available in Passport. You first need to figure out which one you want to use ;)

Please or to participate in this conversation.