Logo
Live
2023Backend · API

Admin Rest API

A secure and scalable Admin API built with Laravel and powered by Passport authentication. Designed to manage users, orders, and admin operations through clean RESTful endpoints.

LaravelPassport (OAuth2/JWT)RBACPHPMySQLREST API
Source on GitHubView Architecture

Screens

Admin Rest API screenshot 1

The Business Problem

Admin backends for e-commerce or ops platforms often bolt on authentication and export features late, leading to inconsistent auth and slow, memory-heavy CSV exports for large order sets.

My Responsibilities

Built the entire API solo: schema design, all 9 controllers, the RBAC middleware, and the CSV export pipeline.

Main Workflows

  1. 1Client logs in via /api/v1/login and receives a Passport-issued OAuth2 token
  2. 2Every protected request is authenticated by the token and gated by the CheckRole middleware for admin/editor-only routes
  3. 3Admins and editors manage products (with image upload to Laravel Storage) and view orders
  4. 4Orders can be exported as CSV via a streaming cursor, so large datasets don't load fully into memory

Tech Stack & Architecture

System Architecture

Click the diagram to open it full size

Standard Laravel layering: routes → middleware → controllers → FormRequests → Eloquent models → API Resources
Passport chosen over Sanctum specifically for full OAuth2 support and token revocation on logout
API Resources explicitly allowlist response fields so password hashes and full role objects never leak
CheckRole middleware centralizes role checks at the route level instead of scattering them across controllers

Security & Deployment

OAuth2 tokens via Laravel Passport, revoked on logout
FormRequest validation on every endpoint, separated from controller logic
Images stored through Laravel's filesystem abstraction (Storage::disk), not written directly into public/ with open permissions
Dockerized deployment: PHP 8.4 FPM + Apache serving the app, MySQL 8 and Redis as separate containers