🚦 Routing in Laravel - web.php vs api.php

Rohit DhimanRohit Dhiman
3 min read

If you're just starting with Laravel, one of the first questions that might pop up is:

What’s the difference between web.php and api.php in the routes folder?

Don’t worry — this guide will help you clearly understand their purpose and when to use which one.


🗂️ Where Are These Route Files?

Laravel keeps its route definitions inside the routes/ directory. Out of the box, you’ll find:

  • web.php: Routes for traditional web interfaces.

  • api.php: Routes for RESTful APIs or mobile app endpoints.

Both files are automatically loaded by Laravel and serve different types of requests using different middleware stacks.


⚙️ Core Differences Between web.php and api.php

1. Middleware Groups

  • web.php routes use the web middleware group.

    • Includes session state

    • Cookie encryption

    • CSRF (Cross-Site Request Forgery) protection

    • Flash messages and other UI-focused features

  • api.php routes use the api middleware group.

    • Designed for stateless API communication

    • Includes rate limiting

    • Often uses token-based authentication


2. URL Prefix

You can customize this behavior, but Laravel gives this convention out-of-the-box to differentiate APIs from web routes.


3. Use Cases

ScenarioUse web.phpUse api.php
Building a traditional web app✅ Yes❌ Not ideal
Handling forms with CSRF✅ Yes❌ No CSRF in stateless APIs
Serving data to a mobile app❌ Not recommended✅ Yes
Stateless REST API✅ Best suited
Using sessions or flash messages❌ APIs are stateless

🧪 Sample Code Comparison

In web.php:

Route::get('/dashboard', [DashboardController::class, 'index']);

In api.php:

Route::get('/users', [UserController::class, 'index']);

Notice how the api.php route will automatically be accessed at /api/users unless you remove or customize the prefix.


💡 Bonus Tip: Create Custom Route Files

As your app grows, you might want to split route files for clarity and structure. You can register your own files in RouteServiceProvider:

Route::middleware('web')
    ->group(base_path('routes/admin.php'));

This is helpful for organizing by role, module, or section of your application.


✅ Final Thoughts

Understanding the difference between web.php and api.php helps you:

  • Avoid misusing middleware

  • Improve security

  • Write more maintainable code

  • Serve both UI and API clients correctly

Whether you're building a full-stack app, a SPA, or an API for a mobile client — Laravel gives you clear tools to route traffic efficiently.


🆕 Note for Laravel 11 Users

⚠️ Laravel 11 no longer includes api.php by default.
But don’t worry — you can generate it using a simple Artisan command:

php artisan install:api

🔁 Your Turn

Which one do you find yourself using more often — web.php or api.php? Let me know in the comments, and feel free to share your own routing tips!


Want more beginner-friendly Laravel content like this?

Connect with me on

GitHub, Substack, or YouTube I share practical, hands-on guides regularly!


More on:

https://linktr.ee/rohitdhiman91


🔖 Tags

#Laravel #PHP #WebDevelopment #Backend #LaravelTips #Routing #BeginnerFriendly #API #devto #Medium #Hashnode #Substack


1
Subscribe to my newsletter

Read articles from Rohit Dhiman directly inside your inbox. Subscribe to the newsletter, and don't miss out.

Written by

Rohit Dhiman
Rohit Dhiman

Laravel developer with 10+ years experience building scalable backends, APIs, and full-stack systems. 💡 Expect posts about: Laravel design patterns Stripe & Twilio integrations RESTful API tips Docker for Laravel devs AWS setups for backend scaling Let’s learn & build together 🚀