Laravel API Development Guide

About this guide

A 22-chapter guide to using Laravel as an API backend. Blade and frontend features are left out; it covers only what an API that returns JSON needs.

What this guide aims at is not "code that works" but "code you can run in production." Every chapter points out the places where following a tutorial gives you something that works and then breaks in production. The order API, for instance, double-allocates stock when two requests arrive at once. The listing API returns other people's data even after you write a Policy. We pick up these traps in the order you meet them.

What makes this guide different

• API only: no Blade, Livewire, or Inertia anywhere. Every chapter is about an API that returns JSON
• One consistent subject: an e-commerce order system, grown over 22 chapters. Each chapter picks up where the last left off
• What matters in production: every chapter has a dedicated section on what breaks when you use the feature in production
• A modern baseline: targets Laravel 13 (released March 2026) and PHP 8.3

How this guide is structured

Chapter outline

Build the foundation (chapters 1-4)

#	Chapter	Overview
01	Introduction	The gap between code that works and code you can operate. The subject, and the endpoints of the finished system
02	The request lifecycle	The path one request takes. bootstrap/app.php and the service container
03	Modeling and seeding	Table design, migrations, enum casts, factories, and seeders
04	Routing and your first endpoint	apiResource(), route model binding, and versioning

From request to response (chapters 5-10)

#	Chapter	Overview
05	Validating input	Fixing the boundary of shape checking with a Form Request
06	Where business logic belongs	Dismantling the Fat Controller. Service classes and the service container
07	Designing the output	Deciding the shape of a response explicitly with an API Resource
08	The listing API	Pagination, filters, and spotting N+1
09	Error design	Translating exceptions into HTTP responses
10	Testing	Pinning down API behavior with Pest

Protect the API (chapters 11-13)

#	Chapter	Overview
11	Authentication	Token authentication with Sanctum. Moving guest orders onto user accounts
12	Authorization	Gates and Policies. Why a Policy does not take effect on the listing API
13	Middleware and rate limiting	Your own middleware, verifying webhook signatures, and RateLimiter

Handle heavy work safely (chapters 14-18)

#	Chapter	Overview
14	Transactions and concurrency	Closing double-allocated stock with row locks and conditional updates. Stopping resubmissions with a unique constraint
15	Events and notifications	Notification and Mailable. Measuring the cost of sending synchronously
16	Queue basics	Job classes, dispatch, and queue:work
17	Queues in production	Idempotency, retries, failed_jobs, and restarting workers
18	Caching	Key design, stampede protection, and invalidation strategy

Supporting features and operations (chapters 19-22)

#	Chapter	Overview
19	File storage	Uploads, signed URLs, and generating PDFs in a job
20	The task scheduler	Collapsing scheduled work into a single cron line
21	Logging, monitoring, and deployment	Structured logs, handling sensitive data, and the deployment procedure
22	Summary	A pre-release checklist

Who this is for

• People who can write basic PHP and are about to build an API in Laravel
• People who have finished a Laravel tutorial but do not know what to watch for in production
• People building the frontend separately who want to use Laravel purely as an API

Prerequisites

Requirement	Knowledge	Notes
Required	Basic PHP 8 syntax (variables, arrays, control flow, functions)	All chapters
Required	Classes, methods, constructors, type declarations, namespaces	All chapters. The design principles themselves are covered in the PHP Class Design Guide
Required	Basic terminal use and installing with Composer	Chapter 2 onward
Recommended	Being able to read SQL SELECT / INSERT / UPDATE	Chapter 3. You do not need to be able to write it
Recommended	Having heard of HTTP GET / POST and how a URL is structured	Chapter 4
Not required	Laravel experience	This guide starts from the basics
Not required	Testing experience	Chapter 10 starts from the basics

How to read it

• New to Laravel: read from chapter 1 in order, running the code as you go
• Comfortable with the basics, here for operations: skim just the "What matters in production" section in each chapter, then read the body of the ones that catch your eye
• Using it as a reference: open the relevant chapter directly from the outline above

What this guide does not cover

Topic	Why
Blade / Livewire / Inertia / Vite	Because the premise is using Laravel as an API. The frontend is assumed to be built separately
Broadcasting (Reverb / Echo)	The client side becomes a JavaScript implementation, which does not fit a guide that leaves the frontend out
Passport / OAuth2	The official position is "Passport only if you need OAuth2." Chapter 11 gives just the criteria for choosing
JWT	A Practical Guide to Laravel × DDD × Clean Architecture devotes a chapter to it
DDD tactical patterns and layered Clean Architecture implementations	Same guide. This one stays with Laravel's standard structure
Index design and normalization theory	The Database Design Guide covers these
Laravel's AI features and vector search	New in Laravel 13, but they take us away from the basics of API development
Docker / server provisioning / CI/CD	Chapter 21 is limited to configuration on the Laravel side

Related guides

• PHP Class Design Guide — the principles of class design themselves. It is the foundation for the criteria used in chapter 6 of this guide
• A Practical Guide to Laravel × DDD × Clean Architecture — the guide to read after this one. It covers designing with separated layers
• Database Design Guide — table design, normalization, and index design

On the overlap with existing guides

Laravel explained from a class design angle currently also appears in the second half of the PHP Class Design Guide. Once this guide is complete, the Laravel part of that one is due to be merged into this guide.