alfasix / alfakit-api

v0.1.0 2026-10-18 13:05 UTC

Requires

• php: ^8.3
• alfasix/alfakit: ^0.1|@dev

Suggests

• laravel/sanctum: Not required: the plugin ships its own hashed personal access tokens. Implement the TokenRepository contract to issue Sanctum tokens instead.

MIT

• Alfa Six

• rest
• api
• laravel
• openapi
• tokens
• alfakit

Published on Packagist.org on 2026-10-18 13:58 UTC

README

_{by Alfa Six}

Automatic, secure JSON REST APIs for the resources of an AlfaKit panel. The API runs each resource's own table (sorting, search, filters), form (validation, defaults, page hooks) and policies, so it can't drift from the panel. It ships hashed personal access tokens with per-resource abilities, tenant isolation, rate limiting, RFC 9457 errors, ETags, idempotency keys and a generated OpenAPI 3.1 document with an in-panel API reference.

Installation

composer require alfasix/alfakit-api
php artisan vendor:publish --tag=alfakit-api-migrations
php artisan migrate

Laravel Sanctum is not required.

Register

use AlfaSix\AlfakitApi\ApiPlugin;
use AlfaSix\AlfakitApi\ResourceApi;

$panel->plugin(
    ApiPlugin::make()
        ->resources([
            CategoryResource::class,
            ResourceApi::make(PostResource::class)
                ->fields(['id', 'title', 'status', 'published_at'])
                ->includes(['author' => ['id', 'name']])
                ->bulkActions(['publish']),
        ])
        ->rateLimit(120),
);

Users create tokens on the API tokens page and read the API reference page; clients call /api/v1/posts with Authorization: Bearer {token}.

See the documentation for every option.

Testing

vendor/bin/pest --test-directory=packages/plugins packages/plugins/api

License

MIT. See LICENSE.md.