How to Create a Secure REST API in PHP 8.x for Mobile Applications

1. Mobile-Specific API Design Principles

• Compact Payloads: Mobile cellular networks incur battery and data costs. Minimize nested JSON payloads and avoid sending unnecessary debug metadata.
• Explicit HTTP Status Codes: Never return 200 OK with {"error": "Unauthorized"} in the body! Use real status codes (401 Unauthorized, 403 Forbidden, 422 Unprocessable Content).
• API Versioning: Always prefix endpoints with /api/v1/ so breaking changes in future app updates never brick older installs.

2. Building a Token-Authenticated Endpoint in Pure PHP

<?php
header('Content-Type: application/json; charset=UTF-8');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');

// Extract Authorization Header
$headers = getallheaders();
$authHeader = $headers['Authorization'] ?? '';

if (!preg_match('/Bearer\s(\S+)/', $authHeader, $matches)) {
    http_response_code(401);
    echo json_encode(['error' => 'Missing or malformed Authorization token']);
    exit;
}

$token = $matches[1];

// Validate token in database with PDO
$stmt = $pdo->prepare("SELECT user_id, expires_at FROM auth_tokens WHERE token_hash = SHA2(?, 256) LIMIT 1");
$stmt->execute([$token]);
$session = $stmt->fetch();

if (!$session || strtotime($session['expires_at']) < time()) {
    http_response_code(401);
    echo json_encode(['error' => 'Token expired or invalid']);
    exit;
}

// Proceed with business logic
echo json_encode([
    'status' => 'success',
    'user_id' => (int)$session['user_id'],
    'data' => ['message' => 'Secure mobile data payload']
]);
?>