I am building an API using Laravel and am looking at using Laravel/Passport for authentication - but I am struggling with a design decision.

The API will be consumed by multiple other applications / sites - initially an Angular web app that administers the data stored in the API, and another than will display certain data, but no updates or deletes etc.

How should I handle the two different types of authentication - ie firstly users who are allowed to log in to the Angular app, and secondly users who are allowed to query the API?

Should these be two different authentication methods/types? Should the Angular app just have a separate database to check users against?


Well the users who are allowed to query the API can pass a secret key while others can login normally. You can add a condition which will confirm the case of API and validate the key.

But it is not good to use a single API for multiple purposes. If you want to authenticate users to login and pass queries to the API then it is better to use dual API.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.