PHP - Block External API Calls

Question

I've created an API in my site in PHP

Now I want to protect it because I don't want that other sites and/or users can call it from a website that it isn't mine

The calls can be made only from my site

How can I do?

Thanks.

There is multiple way to do that, You could simply create a hardcoded password that you have to supply with the credential Or have only static IPs — Nicolas Racine, Apr 12 '16 at 18:12

Adam Lynch · Accepted Answer · 2016-04-14T14:20:00.943

2

You can just use this at the start of your API

if($_SERVER['REMOTE_ADDR'] != '127.0.0.1'){
    die;
}

It will kill any API attempts that aren't being called from your server.

Edit

Or if you want users to be able to call the API, you can gave them an API key, that you will store in your database.

Ex.

$con = mysqli_connect("localhost","my_user","my_password","my_db");
$key = mysqli_real_escape_string($con, $_GET['key']);
$search = mysqli_query("SELECT * FROM user WHERE api_key = '$key'");
if(mysqli_num_rows($search)==0){
    // kill the request
    die;
}
else{
    // Allow the request and do your business
}

edited Apr 14 '16 at 14:20

answered Apr 12 '16 at 18:14

Adam Lynch

331
2
6

the problem is that the users can call the API (it's a registration confirm) and the $_SERVER['REMOTE_ADDR'] tag needs to match site's IP, not user's IP, in your suggestion... – davideakc Apr 13 '16 at 09:52
127.0.0.1 is your site's server ip, not the user's. Why not just make an API key? – Adam Lynch Apr 14 '16 at 14:13
I've edited my answer to show you a way of accepting API keys. – Adam Lynch Apr 14 '16 at 14:20

PHP - Block External API Calls

1 Answers1

Linked