PHP 8.3+ · API-skeleton first

Build production PHP APIs without starting from zero.

A pragmatic, high-performance API framework. Start from glueful/api-skeleton and grow into a full platform — explicit routing, context-aware DI, auth & identity, queues, storage, and generated OpenAPI docs — without the boilerplate.

Get started

Star on GitHub

$router->post('/users', [UserController::class, 'store'])
    ->middleware(['auth', 'rate_limit'])
    ->name('users.store');

#[Controller(prefix: '/api/v1')]
final class UserController extends BaseController
{
    public function __construct(
        ApplicationContext $context,
        private readonly UserService $users,
    ) {
        parent::__construct($context);
    }

    #[Post('/users')]
    public function store(Request $request): Response
    {
        $dto  = CreateUserDTO::fromRequest(RequestHelper::getRequestData($request));
        $user = $this->users->create($this->getContext(), $dto);

        return $this->created($user, 'User created');
    }
}

{
  "success": true,
  "message": "User created",
  "data": {
    "uuid": "u_a1b2c3",
    "email": "[email protected]",
    "status": "active"
  }
}

MIT licensed OpenAPI built-in Context-aware DI First-class CLI 9 official extensions 40k+ resp/sec

Getting started

Up and running in seconds

Scaffold the API skeleton and start a real server — SQLite, queues, and OpenAPI are configured out of the box.

php glueful serve migrate:run

Create a project

$ composer create-project glueful/api-skeleton my-api

Start the server

$ cd my-api && php glueful serve

A CLI for everything

Scaffold code, run migrations and workers, and generate docs — one consistent php glueful entrypoint.

scaffold:controller migrate:run queue:work generate:openapi

Explicit routing, DI & auth

Context-aware services, attribute routing, and JWT / session / API-key auth over a pluggable user store.

ApplicationContext #[Controller] #[RequireScope]

Queues, OpenAPI & extensions

Background jobs, generated OpenAPI + typed SDKs, and an official extension ecosystem you add as you grow.

queue:work generate:openapi --ui glueful/aegis

A request has one clear path

Thin controllers, validation in DTOs, business logic in services, data access in repositories — easy to read, easy to test, with no hidden magic or global state.

Thin controllers that just shape the response
Validation in DTOs, orchestration in services
Context-aware DI — no hidden globals
N+1 detection & query caching built in

Explore the architecture

$router->post('/users', [UserController::class, 'store'])
    ->middleware(['auth', 'rate_limit']);

public function store(Request $request): Response
{
    $dto  = CreateUserDTO::fromRequest(RequestHelper::getRequestData($request));
    $user = $this->users->create($this->getContext(), $dto);

    return $this->created($user, 'User created');
}

public function create(ApplicationContext $ctx, CreateUserDTO $dto): array
{
    return db($ctx)->transaction(function () use ($dto) {
        $user = $this->users->insert($dto->toArray());
        $this->events->dispatch(new UserCreated($user));

        return $user;
    });
}

public function insert(array $data): array
{
    $data['uuid'] = Utils::generateNanoID();
    $this->db->table('users')->insert($data);

    return $this->findByUuid($data['uuid']);
}

Out of the box

What you get immediately

The starter path shortens the gap between “new project” and “working API with operational basics.”

Scaffolding

Generate controllers, models, DTOs, jobs, rules, tests, factories, seeders, filters, and middleware with the scaffold commands.

API documentation

generate:openapi --ui produces your spec and a browsable UI — no separate docs stack to maintain.

Operational defaults

Health checks, security scanning, route diagnostics, queue presets, and deployment-oriented config from the start.

Rate limiting

Per-route, builder-configured throttling with sliding-window algorithms and pluggable storage.

Field selection

GraphQL-style fields and expand projection with depth limits and whitelist protection.

Testing

PHPUnit 10 with a real booted app for feature tests and a lightweight SQLite harness for libraries.

Official packages

Grow with official extensions

Keep the core lean; add product capabilities as Composer packages when you need them.

Auth

Identity & access

Authenticate users and authorize every request — a pluggable user store, role-based access control, and OAuth / SSO.

Users Aegis Entrada

Messaging

Reach your users

Transactional email, push notifications, and SMS / WhatsApp messaging from one consistent delivery API.

Email Notiva Conversa

Data & billing

Search & payments

Full-text search and a unified payment-gateway bridge — added as Composer packages when you need them.

Meilisearch Payvia

Runtime

Performance at scale

Run long-lived PHP processes on RoadRunner, Swoole, or FrankenPHP for higher throughput on the same code.

Runiva

Browse all extensions

Quickstart

From new project to first endpoint in minutes

Scaffold the skeleton, generate a controller, and ship documented JSON — in a handful of commands, no boilerplate to wire up first.

Read the quickstart

$ composer create-project glueful/api-skeleton my-api

Installing dependencies… done

$ cd my-api && php glueful serve

✓ Server running http://localhost:8000

$ php glueful scaffold:controller Post --api

✓ Created PostController

$ curl localhost:8000/api/posts

{"success":true,"data":[]}