title: Securing API in lumen
body: <p>im new in lumen and im trying to secure my registration api by putting a code called Api-Token so only users that know the code can create a new user but everytime i try to create a new user i cant do it</p>
  
  <p>here is what ive done so far</p>
  
  <p>Middleware/Authenticate</p>
  
  <pre><code>&lt;?php
  
  namespace App\Http\Middleware;
  
  use Closure;
  use Illuminate\Contracts\Auth\Factory as Auth;
  use App\User;
  
  class Authenticate
  {
  /**
   * The authentication guard factory instance.
   *
   * @var \Illuminate\Contracts\Auth\Factory
   */
  protected $auth;
  
  /**
   * Create a new middleware instance.
   *
   * @param  \Illuminate\Contracts\Auth\Factory  $auth
   * @return void
   */
  public function __construct(Auth $auth)
  {
      $this-&gt;auth = $auth;
  }
  
  /**
   * Handle an incoming request.
   *
   * @param  \Illuminate\Http\Request  $request
   * @param  \Closure  $next
   * @param  string|null  $guard
   * @return mixed
   */
  public function handle($request, Closure $next, $guard = null)
  {
  
      if ($this-&gt;auth-&gt;guard($guard)-&gt;guest()) {
          if ($request-&gt;has('api_token')) {
              $token = $request-&gt;input('api_token');
              $check_token = User::where('api_token', $token)-&gt;first();
              if ($check_token == null) {
                  $res['success'] = false;
                  $res['message'] = 'Permission not allowed!';
  
                  return response($res);
              }
          }else{
              $res['success'] = false;
              $res['message'] = 'Unauthorized!';
  
              return response($res);
          }
      }
      return $next($request);
  }
  }
  </code></pre>
  
  <p>AuthServiceProvider</p>
  
  <pre><code>&lt;?php
  
  namespace App\Providers;
  
  use App\User;
  use Illuminate\Support\Facades\Gate;
  use Illuminate\Support\ServiceProvider;
  
  class AuthServiceProvider extends ServiceProvider
  </code></pre>
  
  <p>{
      /**
       * Register any application services.
       *
       * @return void
       */
      public function register()
      {
      }</p>
  
  <pre><code>/**
   * Boot the authentication services for the application.
   *
   * @return void
   */
  public function boot()
  {
      // Here you may define how you wish users to be authenticated for your Lumen
      // application. The callback which receives the incoming request instance
      // should return either a User instance or null. You're free to obtain
      // the User instance via an API token or any other method necessary.
  
      // $this-&gt;app['auth']-&gt;viaRequest('api', function ($request) {
      //     $header = $request-&gt;header('Api-Token');
  
      //     if ($header &amp;&amp; $header == 'bird is a word') {
      //         return new User();
      //     }
  
      //     return null;
  
      $this-&gt;app['auth']-&gt;viaRequest('api', function ($request) {
          if ($request-&gt;input('api_token')) {
              return User::where('api_token', $request-&gt;input('api_token'))-&gt;first();
          }
  
      });
  }
  }
  </code></pre>
  
  <p>Routes</p>
  
  <pre><code>&lt;?php
  
  
  $app-&gt;get('/', function () use ($app) {
  $res['success'] = true;
  $res['result'] = "Hello there welcome to web api using lumen tutorial!";
  return response($res);
  });
  
  $app-&gt;post('/login', 'LoginController@index');
  $app-&gt;post('/register', ['middleware' =&gt; 'auth', 'uses' =&gt; 'UserController@register']);
  $app-&gt;get('/user/{id}', ['middleware' =&gt; 'auth', 'uses' =&gt;  'UserController@get_user']);
  </code></pre>