Overview

Overview

The Mobile App Boilerplate follows a unified REST API specification to ensure seamless integration between the Flutter application and the backend services.

The backend exposes two implementations of the same mobile contract:

• Admin Panel (Laravel) — Owns /api/v1/auth/*, /api/v1/uploads, and /api/v1/webhooks/revenuecat.
• Shared Mobile Contract — /api/v1/app/* is implemented by both Laravel admin-panel and Go api-backend.

Both services share the same database and use Laravel Sanctum for token-based authentication. The /api/v1/app/* contract can be routed to either backend, and both implementations validate the same Sanctum tokens.

Base Configuration

All requests follow this standard:

• Path Versioning: All endpoints are prefixed with /api/v1.
• Headers:
  • Content-Type: application/json
  • Accept: application/json

Authentication Standard

The API architecture standardizes on Bearer Token Authentication using Laravel Sanctum Personal Access Tokens.

• Bearer Tokens: Protected endpoints require a valid token in the Authorization header.
• Unified Flow: Authentication logic (Login, Register, Social Auth) returns a consistent payload containing the user object and the access token.
• Granular Scopes: Tokens are issued with specific abilities (e.g., user:read, notifications:update) to restrict permissions.
• Cross-Service: A token issued by the Laravel admin-panel will be valid for either /api/v1/app/* implementation.

Response Consistency

Both implementations return identical JSON structures. This ensures the Flutter app's data models remain stable.

Success Response

{
  "success": true,
  "message": "Optional success message",
  "data": { ... }
}

Error Response

Standard HTTP status codes are used across both implementations:

• 401 Unauthorized: Missing or invalid token.
• 422 Unprocessable Entity: Validation failed.
• 429 Too Many Requests: Rate limit exceeded.

Example Validation Error:

{
  "message": "The given data was invalid.",
  "errors": {
    "email": ["The provided credentials are incorrect."]
  }
}

Next Steps

Explore the detailed API Routes to see the canonical endpoint prefixes and the shared /api/v1/app/* route set.