I’m currently considering options for a project that will require a standard sales site, commerce features and a user database. The user database will require a web frontend and an API for communication with a mobile app (read and write).
My dilemma is whether it makes sense to consider Craft for all three components, which will give us all the benefits of a unified system, or to split the user database into a separate project where we could take advantage of something like Laravel Passport, which seems like the obvious option for efficiently building a secure API.
The HTTP Messages plugin looks useful but doesn’t appear to deal with authentication at all and preexisting options for Yii/Craft OAuth appear limited to nonexistent. I get the sense that Craft 3/Yii 2 would make life easier, but waiting for a stable Craft 3 release isn’t possible.
Has anyone had any experience developing a secured API on top of Craft? If so, what route did you take and would you do it again?