PHPAML

Documentation · Chapter 12

Protect and stabilize production actions.

Bearer tokens identify callers. Abilities authorize actions. Rate limiting, idempotency, CORS, and request IDs address different reliability risks.

Every lesson starts from the problem, explains the mechanism, then gives a concrete verification.

Authenticate then authorize

Authorization: Bearer token authenticates. Ability middleware checks scopes such as movies:read or movies:write. A valid token may still lack permission.

phpaml — zsh
Authorization: Bearer phpaml_token_here
Idempotency-Key: create-movie-2026-001
X-Request-ID: client-trace-1234

Retry without duplication

An Idempotency-Key lets a client safely retry a creation after a timeout. The cache is scoped to authenticated identity so one caller cannot receive another caller's response.

Observe and limit

CORS controls browser origins, not server authentication. Request IDs connect responses to logs; rate limits slow abuse.