Download the PHP package yusufgenc/filament-api-forge without Composer

Filament API Forge

Automatically expose your Filament Resources as fully-featured REST APIs — with hash-based authentication, interactive OpenAPI documentation, per-resource access control, rate limiting, and IP restrictions. No Sanctum required.

Screenshots

Developer Center

API Keys

API Docs

Access Control

Settings

Public Docs — Light Mode

Public Docs — Dark Mode

Features

Requirements

• PHP 8.2+
• Laravel 12+
• Filament 5.x
• Spatie Laravel Query Builder 5+

Installation

Publish and run the migrations:

Optionally publish the config file:

Setup

1. Register the Plugin

Add FilamentApiForgePlugin to your panel provider:

All three are enabled by default. You can disable any section:

2. Expose a Resource

Implement HasApi on any Filament Resource and define apiConfig():

apiConfig() Reference

3. Enrich the OpenAPI Docs (optional)

Decorate your Resource class with PHP 8 attributes to improve generated documentation:

Authentication

All API requests must include a Bearer token:

Token Format

Tokens use the forge_ prefix followed by 40 random characters (238 bits of entropy). The plain-text token is shown once at creation — only its SHA-256 hash is stored.

Scopes

Tokens can also be restricted to specific resources via Resource Access in the API Keys page.

Making API Requests

The base URL pattern is:

Where {segment} is the panel ID (admin) by default, or a custom route segment if configured.

Examples

Query Parameters

Response Format

Collection (index)

Single record (show / store / update)

Error responses

Developer Center

The Developer Center is embedded in your Filament panel under the Developer Center navigation group.

Access Control

The Access Control page lets you manage per-resource settings without touching code.

• Enable / Disable a Resource — toggle the resource on or off. Disabled resources return 404.
• Enable / Disable Methods — toggle specific HTTP methods. Disabled methods return 405.
• Rate Limiting — set limits at resource or method level. Method limits override resource limits, which override the global config value.
• IP Restrictions — whitelist IPs at resource or method level. Supports exact IPs, CIDR ranges (10.0.0.0/8), and wildcards (192.168.1.*).

Public API Docs

The Publish Docs button on the API Docs page makes your documentation available at a public URL — no login required:

The page uses Swagger UI with full light/dark mode support (default light, toggle persisted in localStorage). When unpublished, the URL returns 403.

The Copy Public URL button (visible when published) shows the URL in a notification for easy copying.

Route Segment

By default, API paths include the Filament panel ID:

You can replace admin with any custom segment from Developer Center → Settings, or via environment variable:

Result:

Note: Both the original panel-ID paths and the new segment work simultaneously — no breaking changes to existing integrations.

The Settings page shows a live Route Preview table so you can see exactly how paths will appear in the docs before saving.

Request Counters

Every API call increments the request_count on the token used. The Dashboard displays the all-time total with abbreviated formatting (1.2K, 3.5M, 2.1B — hover for exact value).

From Settings → Request Counters you can:

• See per-token counts (top 10 by usage, with last-used time)
• Reset all counters to zero with a single click (useful after testing or a new release)

Configuration

License

This package is open-sourced software licensed under the MIT license.

Credits

Built by Yusuf Genc.
Powered by Filament and Spatie Laravel Query Builder.