Native REST API Authentication 👮‍♂️

[j-vitali]

Hi guys, do you plan to add REST API authentication in future?
Or I should build my own?

[duncanmcclean]

I don't believe we're planning to add authentication to the REST API in the short term. However, feel free to add your 👍 to the open feature request: statamic/ideas#215.

[jackmcdade]

You could also check out https://statamic.com/addons/tv2reg/private-api

[ghost]

any updates guys??

[remluben]

Any news on this? 😄

[vitalijalbu]

Any news on this? 😄

i did it using sanctum, pretty simple...

[duncanmcclean]

Sorry, there hasn't been any movement on this.

Leave a 👍 reaction and "Subscribe" to the the feature request to be notified when there's any progress.

[remluben]

Any news on this? 😄

i did it using sanctum, pretty simple...

Did you also turn of Statamic caching for api routes to fully protect? I ran into issues where after an authenticated and authorized user loaded resources from an api endpoint, Statamic made cached response take priority over auth middleware, thus returned data even for unauthenticated users.

It would be nice to know if anyone else needed this in config/statamic/api.php

    'cache' => [
        'expiry' => false, // Disable caching to prevent serving cached content to unauthenticated users
    ],

[ryanmitchell]

Yes you need to turn off caching