Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

belic_a's avatar

API Authorization multiple roles

First of all I would like to say hi, because I'm new on this forum.

I'm having difficulties understanding laravel authorization in general. I would like to know what would be clean approach to solve authorization in system described below:

I'm using laravel 10.
Building backed API meant to be used with SPA VUE 3 Frontend and mobile app.
For now I have 3 types of users (Lets say Admin, Manager and Client).
Client has very low permissions for example, client can create account, see some announcments , and edit some of account info.
Manager can add clients, view clients, edit client data ....etc 
Admin is the boss so he can do everything.

I found a solution to make different route routes for let's say admin and manage: for example: /api/admin/add_client /api/manager/add_client my routes are currently same for all user types, so only /api/add_client Is this the right approach and what is the best way to do authorization based on user roles.

Also I don't have roles table because users cant have multiple roles so it seemed cleaner to only add field in user table. So do I need roles table and what are the benefits of using one except multiple user roles?

0 likes
0 replies

Please or to participate in this conversation.