Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

mattbryanswan's avatar

Best practices for Laravel API Sandbox

Hello,

What's the best way to set up a sandbox for my API?

Here's the scenario - I have some third-party developers helping with our mobile app. I want to get them data in the correct structure, but I do not want to give them the actual data because that data is the most important part of our app. If they use the API to in effect scrape our data, we'll be a bad position strategically.

It seems like the simplest solution is to just create a sandbox using fake data - this way they'll get what they need to develop on our behalf, while we do not compromise our data.

But what is the best way to go about this? It would seem that I would need a different database, as any solution using the same database would likely require all sorts of logical coding where problems could occur and leak data.

Thanks in advance for the insights!

-Matt

0 likes
6 replies
NickVahalik's avatar

Set up [DB seeders] and use Fakery to load up the database with fake records. Or alternatively, ship a SQLite DB with the data you want them to use and show them how to configure it.

mattbryanswan's avatar

Thanks for your reply, but I'm not sure either solution is what I'm looking for.

I realize I'd have to seed a second database to backend the sandbox, but that wouldn't be sufficient. I was more asking about the best way to go about that - so, for example, is there a good place to set the connection for one set of API paths versus another one? How might I go about implementing keys that are restricted to specific environments? etc.

Shipping a SQLite db isn't an option because then they wouldn't be using the API anymore - it would create distance between the development and production environments and cause a lot of complexity.

Ideally, I'd like to find a way to create two endpoints:

Prod: api.mysite.com Dev: sandbox.api.mysite.com

where the endpoint should be set as an environment variable, so that they can develop using the sandbox, but when I accept code into the repo and deploy it, it will use the production endpoint with my production key to get real data instead of the sandbox data.

Anyone have any other insights?

Thanks!

-Matt

jimmy.puckett's avatar

We have our CI pipline build an environment for development. The job is ran on every push but can be scheduled to run nightly to clean the db.

Please or to participate in this conversation.