CARVIEW |
Select Language
HTTP/2 200
date: Wed, 23 Jul 2025 20:27:31 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With
etag: W/"aae83aa6ba2cfd60333d1d482d5c65f1"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=qNR3FH%2BEinm48%2Bu0mTpkUGGmaPlFm0a120VofMA40chBHYv8%2BR9N1gX7vj%2B9SK1goslEg5Fk9bLg1gaWP%2FRxQfCta0hXqKYvM5OAcSCZrLExOymIOTd3hx01iSSRhhb%2BaVAtkaXNN7nzqu8zV%2Bgpc9sFNGUHZz4fkZovFaKJCk9Kj1hLhRJufa9M%2BJgpfDkeIfKTDMqM8TjxjVNwEZRJoItdNSvidVjOJ%2B7WdaEU%2BFYB5X%2FfwDdkDb5LNJX0%2FAGklkSeRFBCEsSE1BB6gvj1Tw%3D%3D--k4ugO%2Bes8O1kzrQi--aTldSDIuRzL3Xa8wFkLtbw%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.1561720818.1753302450; Path=/; Domain=github.com; Expires=Thu, 23 Jul 2026 20:27:30 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Thu, 23 Jul 2026 20:27:30 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: A61C:12BD61:10942E2:13B57D3:688145B2
OAuth 2.0 · dingo/api Wiki · GitHub
Skip to content
Navigation Menu
{{ message }}
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
OAuth 2.0
Tine Jozelj edited this page Jul 28, 2015
·
3 revisions
See the Authentication chapter for a guide on how to configure an OAuth 2.0 provider.
By using scopes you'll have more control over who can access your protected endpoints. Scopes can be set on a group or a route as either an array of pipe delimited string.
$api->version('v1', ['middleware' => 'api.auth', 'scopes' => ['read_user_data', 'write_user_data']], function ($api) {
// Only access tokens with the "read_user_data" scope will be given access.
});
$api->version('v1', ['middleware' => 'api.auth'], function ($api) {
$api->get('user', ['scopes' => 'read_user_data', function () {
// Only access tokens with the "read_user_data" scope will be given access.
}]);
});
If your controllers use the Dingo\Api\Routing\Helpers
trait you can use the scopes
method.
use Dingo\Api\Routing\Helpers;
class UserController extends Controller
{
use Helpers;
public function __construct()
{
$this->scopes('read_user_data');
}
}
You can define the methods you want the scopes to apply to via the second parameter, either as a pipe separated string or as an array. If you do not supply the methods then the scopes will apply to all methods. You can also use the except
and only
array keys to apply the scopes to a subset of methods.
use Dingo\Api\Routing\Helpers;
class UserController extends Controller
{
use Helpers;
public function __construct()
{
// Only apply to the index method.
$this->scopes('read_user_data', 'index');
// Apply to every method except the store method.
$this->scopes('read_user_data', ['except' => 'store']);
// Apply only to the store method.
$this->scopes('write_user_data', ['only' => ['store']]);
}
public function index()
{
//
}
public function store()
{
//
}
}
You can’t perform that action at this time.