PHP APIs

PHP API development for apps, SPAs and partners

We design and build REST APIs that other teams can integrate without phoning you. Predictable resources, clear errors, documented in OpenAPI and covered by contract tests before the first consumer connects.

  • We build the client apps too
  • Contract written before code
  • Sandbox for your integrators
Get a free quote See our work
What is included
  • Resource design
  • Version policy
  • Authentication and scopes
  • Input checks and one error format
  • Paging, filtering and rate limits
  • Docs generated from the contract
Get a free quote Reply within one business day. NDA on request.
The problem

What breaks between server and client

An API is a promise to people you may never meet: the mobile developer at another agency, the integration team at a partner company, your own front-end developer two years from now. They cannot see your code. All they have is the URL, the documentation and whatever the server sends back when something goes wrong.

We build PHP APIs with that reader in mind. The work includes new backends for mobile apps, JSON layers over legacy PHP systems so a modern front end can replace old pages, and partner APIs with keys, quotas and usage logs. We have developed 100+ mobile apps and many of the web front ends that call services like these, including mobile app API integration projects, so we know which shortcuts on the server turn into weeks of pain on the client.

  • Every endpoint behaves differently

    One returns a bare list, another wraps it in a data key, a third answers errors with a success status and a message string. Each consumer writes special cases, and each special case is a bug in waiting.

  • A server change broke the mobile app

    A field was renamed to tidy things up, and an older app release still installed on many phones started crashing. There was no versioning and no way to know who relied on what.

  • Partners want access you cannot safely give

    A reseller asks for an integration and the only option is sharing an admin login or a database dump. You need scoped keys, limits and a log of what was called.

  • The documentation is a stale wiki page

    Integrators learn the API by trial and error and by emailing your developer. Onboarding each new consumer costs days on both sides.

What we do

Six things every PHP API of ours has

We treat the API as a product with its own users. These six elements are in scope on every build.

Resource design

Nouns for URLs, HTTP verbs for actions, consistent JSON shapes, and status codes that mean what the specification says. Related records are embedded or linked by one rule across the API.

Version policy

A version in the path or a header, additive changes within a version, and a written deprecation policy. Old mobile app releases keep working while new ones move ahead.

Authentication and scopes

Bearer tokens for first-party apps, OAuth2 flows for third parties, signed JWTs where stateless checks help, and API keys with scopes for server-to-server partners.

Input checks and one error format

Input validated at the edge with field-level messages, and one error format everywhere, carrying a stable machine-readable code alongside the human explanation.

Paging, filtering and rate limits

Cursor or page-based pagination with filtering and sorting on whitelisted fields, plus per-key rate limits that answer with a clear status and a retry hint.

Docs generated from the contract

An OpenAPI file kept in the repository, rendered as browsable docs with examples you can run, and checked against the real responses in the test suite.

Typical projects

APIs we are asked to build

01

JSON backend for iOS and Android apps

Registration, sign-in, profiles, content feeds and push notification tokens served to iOS and Android clients, with sync endpoints designed for patchy connections.

02

JSON layer over legacy PHP

JSON endpoints added in front of an existing PHP application and its database, so a React or Vue front end or a new app can replace old screens one at a time.

03

Keys and quotas for partners

Scoped keys, quotas, sandbox accounts, usage logs and outgoing webhooks, so partners can place orders or pull data without manual exports from your staff.

04

Integration hub

A small service that receives webhooks, normalizes data and passes it between your store, CRM, accounting and warehouse systems, with retries and a replay screen for failures.

In depth

What we settle before writing endpoints

The specification is written first

We write the OpenAPI specification first and review it with whoever will consume the API. Arguments about field names, nesting and nullability are settled in a document, where changing your mind costs minutes. Front-end and mobile developers can then work against a mock server generated from the same file while the real endpoints are built. Dates are ISO 8601 in UTC, money is an integer amount in minor units with a currency code, IDs are opaque strings. Small rules like these, applied without exception, remove most integration bugs.

Tokens, OAuth2 or keys

There is no single right answer here, only a fit for each kind of consumer.

  • Your own mobile app or SPA: short-lived access tokens with refresh tokens that can be revoked per device, or secure cookies for a same-domain SPA.
  • Third parties acting for a user: the OAuth2 authorization code flow with PKCE, so passwords never pass through the partner.
  • Server-to-server partners: API keys or client credentials, each with scopes and its own rate limit.

JWTs are useful when several services must verify a token without a database lookup. They are also hard to revoke, so we keep their lifetime short and do not reach for them by default.

Changing the API while old apps are still installed

Mobile apps make this unavoidable, because you cannot force every phone to update. Within a version we only add: new optional fields, new endpoints. Removing or renaming anything means a new version, and the old one stays up for an agreed period while usage logs show who still calls it. Contract tests replay the documented examples against every build, so an accidental change to a response fails the pipeline and never reaches a consumer.

Protecting the API from its own clients

Most overload comes from a well-meaning client stuck in a retry loop, far more often than from an attacker. Rate limits per token and per IP address, counted in Redis, keep one consumer from starving the rest. List endpoints always paginate, with a hard maximum page size. Write endpoints that create payments or orders accept an idempotency key, so a request retried after a timeout does not create a duplicate. Expensive reads get cache headers and conditional requests.

What it is built from in PHP

A small service needs no full framework. We assemble it from PSR-7 request and response objects and PSR-15 middleware for authentication, rate limiting and CORS, with Slim as the router and the PHP League OAuth2 server issuing tokens. Larger APIs with queues, mail and a big data model usually benefit from the tooling a framework brings, which is covered on our Laravel API development and CodeIgniter API development pages. The design rules above stay the same whichever one runs underneath.

Process

Contract first, then code

  1. 1

    Who calls it and why

    We ask who will call the API, from what kind of client, how often and for which tasks, and collect any existing integrations that must keep working.

  2. 2

    Specification and mock

    The OpenAPI document is drafted, reviewed and published with a mock server, so client teams can start building in parallel.

  3. 3

    Endpoints in the sandbox

    Endpoints are built resource by resource with validation, authorization and tests, and deployed to a sandbox environment as they are completed.

  4. 4

    Limits, logs and abuse checks

    Rate limits, logging, monitoring and load checks are added, and authentication is tested for common failures such as reading another account's record by guessing its ID.

  5. 5

    Onboarding and support

    Consumers receive keys, docs and a changelog. We watch error rates during the first integrations and adjust where real usage differs from the plan.

Deliverables

Handed to your integrators

  • An OpenAPI specification kept in step with the code
  • A sandbox environment with sample data
  • Consistent errors, pagination and naming across endpoints
  • Contract tests that catch breaking changes
  • A changelog and deprecation notices for consumers
FAQ

API questions worth asking early

Would GraphQL suit us better than REST?
Probably not. REST suits most projects and is what we recommend by default, because caching, tooling and partner familiarity are all on its side. GraphQL earns its place when many different clients need very different slices of the same data. We explain the trade-off for your case before any code is written.
Our PHP system has no API. Can one be added without a rewrite?
Yes. We add a JSON layer that reuses your current database and business rules, without rewriting the application behind it. Where the old code is too tangled to call directly, we wrap it step by step and add tests around each part we touch.
How do you keep an API secure?
Every request is authenticated, authorized against the specific record, validated and rate limited, and all traffic runs over HTTPS. Tokens are stored hashed, secrets stay out of the repository, and access is logged. On request we test against the OWASP API Security guidance and share the findings.
Will you build the mobile app or front end that uses the API too?
We can. Our mobile app development team builds Flutter and native clients, and our front-end developers work in React and Vue. If another team is building the client, we work from the shared specification and join their channel.
What documentation do we get?
You receive the OpenAPI file, hosted interactive documentation, a Postman collection, a getting-started guide covering authentication, and a changelog. The examples in the docs are executed by the test suite, so they cannot drift from what the server really returns.
How is API work priced?
Cost follows the number of resources, the complexity of the authentication model, the number of outside systems involved, and the level of documentation and sandbox support your partners need. You get a quote split into milestones after a free consultation.
What happens when we need to change the API later?
Additive changes ship within the current version at any time. Breaking changes go into a new version with a migration note, and the old version keeps running for a period we agree with you. Usage logs tell us which consumers still need to move.
Related

Laravel API Development

CodeIgniter API Development

Mobile App API Integration

API Development & Integration

PHP SaaS Development
Start a project

Planning an API, or fixing one that hurts?

Tell us who needs to connect and what they need to do. An engineer who builds both servers and clients replies within one business day, and the consultation and quote are free.

  • Free consultation and quote
  • NDA on request
  • You own the source code
  • Reply within one business day
Prefer to talk first? Book a call WhatsApp wwc@worldwincoder.com
Add budget and timeline optional, helps us quote faster

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.