After a decade building Laravel APIs for clients on Upwork, here are the patterns I reach for on every new project.
1. Always use API Resources
Never return Eloquent models directly. JsonResource gives you a stable contract, hides internal columns, and makes versioning sane.
2. Version from day one
Even if you only ship v1 today, route under /api/v1. Adding v2 later without breaking mobile clients is priceless.
3. Rate limit per user, not per IP
RateLimiter::for('api', fn ($r) => Limit::perMinute(60)->by($r->user()?->id ?: $r->ip())) — protects shared offices and CGNAT users.
4. Validate with Form Requests
Keep controllers thin. Form Requests centralize validation and authorization in one place.
5. Return problem+json on errors
A consistent error envelope ({ message, errors, code }) saves your frontend team hours.
Advertisement