Make an API call access an API from PHP

What is an API

Use API data in a web application

Install Composer manage third-party packages and autoload class files

Introduction and welcome how to get the most out of the course

Install a package with a web server, PHP, a database server and phpMyAdmin

Request headers add meta data about the request

Use cURL instead of file get contents to make an API request

Response codes get the HTTP status code

Get all individual response headers in an array

Response headers read meta data about the response

Use an API that requires a specific request header

Request method change the method to get a different result with the same URL

Request body add a payload to send data along with the request

REST and RESTful APIs what are they

Access a RESTful API in PHP with cURL

Use the Guzzle HTTP client for object-oriented API code

Use an SDK compare the Stripe API to its SDK

The front controller get the resource, ID and the request method

Start writing the API enable URL rewriting

Use a client for API development cURL, Postman or HTTPie

Set the HTTP status code best practices

Add a controller class to decide the response

Use Composer's autoloader to load classes automatically

Always return JSON add a generic exception handler and JSON Content-Type header

Make debugging easier add type declarations and enable strict type checking

Send a 405 status code and Allow header for invalid request methods

Create a new database and a database user to access it

Create a table to store resource data

Connect to the database from PHP add a Database class

Create a table data gateway class for the resource table

Configure PDO to prevent numeric values from being converted to strings

Move the database connection data to a separate .env file

Show a list of all records

Convert database booleans to boolean literals in the JSON

Show an individual record

Respond with 404 if the resource with the specified ID is not found

Insert a record into the database and respond with a 201 status code

Get the data from the request as JSON

Add a generic error handler to output warnings as JSON

Validate the data and respond with a 422 status code if invalid

Conditionally validate the data when updating an existing record

Get the data from the request for updating an existing record

Update the record in the database and return a 200 status code

Delete the record in the database and return a 200 status code

Create a table to store user account data

Add a register page to insert a new user record and generate a new API key

Send the API key with the request query string or request header

Check the API key is present in the request and return 400 if not

Create a table data gateway class for the user table

Authenticate the API key and return a 401 status code if invalid

Refactor the front controller to a bootstrap file and Auth class

Add a foreign key relationship to link task records to user records

Retrieve the ID of the authenticated user when authenticating

Restrict the tasks index endpoint to only show the authenticated user's tasks

Restrict the rest of the task endpoints to the authenticated user's tasks

Cache the database connection to avoid multiple connections in the same request

An introduction to authentication using access tokens

Generate an encoded access token containing the user details

Select the user record based on the username in the request

Check the username and password and return a 401 status code if invalid

Create the login script and return 400 if the username and password are missing

Pass the access token to the task API endpoints in the authorization header

Validate the access token and decode its contents

Get the authenticated user data from the access token

An introduction to JSON web tokens (JWTs)

Generate a JWT access token in the login endpoint containing JWT claims

Create a class to encode a payload in a JWT

Pass in the secret key used for hashing as a dependency

Add a method to decode the payload from the JWT

Use a custom exception class to return 401 if the signature is invalid

Don't store sensitive data in the JWT

Authenticate the task endpoints using the JWT

Why access tokens need to expire and how to refresh them in a user-friendly way

Add an expiry claim to the access token payload when logging in

Throw a custom exception to not accept the JWT if it has expired

Add a refresh endpoint and validate the refresh token in the request

Issue a refresh token in addition to the access token when logging in

Validate the user in the refresh token using the database

Issue a new access token and refresh token to the authenticated user

Create a table to store a refresh token whitelist

Store the refresh token in the whitelist when issued in the login endpoint

Replace the refresh token in the whitelist when issued in the refresh endpoint

Validate the refresh token is on the whitelist and return a 400 response if not

Add a logout endpoint to remove the an active refresh token from the whitelist

See how a single-page application interacts with the API using access tokens

Add a script to clear out expired refresh tokens from the whitelist

Conclusion & where to go from here