Building RESTful Web Services with PHP 7

Securing API endpoints

First, we need to understand how authentication and login works. The first time client side application sends login credentials (that is mostly email address and password). On the basis of those credentials, the server-side login endpoint makes the user's login and returns a token against that authenticated user. That token is stored on the client side. On every request, the client side has that token either in a request body or in a request header. It can be more clearly seen in the following diagram.

The first client will hit the login endpoint on the server with the login credentials:

Once the client gets the token, ...