PHP - Block External API Calls

Question

I've created an API in my site in PHP

Now I want to protect it because I don't want that other sites and/or users can call it from a website that it isn't mine

The calls can be made only from my site

How can I do?

Thanks.

There is multiple way to do that, You could simply create a hardcoded password that you have to supply with the credential Or have only static IPs — Nicolas Racine
– Nicolas Racine, Commented Apr 12, 2016 at 18:12

Adam Lynch · Accepted Answer · 2016-04-14 14:20:00Z

2

You can just use this at the start of your API

if($_SERVER['REMOTE_ADDR'] != '127.0.0.1'){
    die;
}

It will kill any API attempts that aren't being called from your server.

Edit

Or if you want users to be able to call the API, you can gave them an API key, that you will store in your database.

Ex.

$con = mysqli_connect("localhost","my_user","my_password","my_db");
$key = mysqli_real_escape_string($con, $_GET['key']);
$search = mysqli_query("SELECT * FROM user WHERE api_key = '$key'");
if(mysqli_num_rows($search)==0){
    // kill the request
    die;
}
else{
    // Allow the request and do your business
}

edited Apr 14, 2016 at 14:20

answered Apr 12, 2016 at 18:14

Adam Lynch

3312 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

davideakc Over a year ago

the problem is that the users can call the API (it's a registration confirm) and the $_SERVER['REMOTE_ADDR'] tag needs to match site's IP, not user's IP, in your suggestion...

Adam Lynch Over a year ago

127.0.0.1 is your site's server ip, not the user's. Why not just make an API key?

Adam Lynch Over a year ago

I've edited my answer to show you a way of accepting API keys.

Collectives™ on Stack Overflow

PHP - Block External API Calls

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related