API Security Best Practices

API endpoints require robust authentication and request rate limiting to protect databases against credential stuffing and DDoS attacks.

Sanctum Token Authentication Flow

use App\Models\User;
use Illuminate\Support\Facades\Hash;

public function login(Request $request)
{
    $request->validate([
        'email' => 'required|email',
        'password' => 'required',
    ]);

    $user = User::where('email', $request->email)->first();

    if (! $user || ! Hash::check($request->password, $user->password)) {
        return response()->json(['message' => 'Invalid credentials'], 401);
    }

    $token = $user->createToken('api-token')->plainTextToken;

    return response()->json(['token' => $token, 'user' => $user]);
}

Enforcing rate limiting with RateLimiter::for('api') protects application throughput while ensuring high availability.