Dotkernel API

Bearer tokens, issued and validated by the API itself.

Authentication runs on mezzio-authentication-oauth2, which wraps league/oauth2-server to provide OAuth 2.0 for PSR-7 / PSR-15 applications. Endpoints marked as authenticated require a valid Bearer token and answer 401 Unauthorized without one.

Three levels of protection: none, authenticated, authorized.

Roles and their permissions are declared in configuration and allocated per route name, with role inheritance supported. An authenticated request that lacks the required permission gets a 403 Forbidden - decided by config, not scattered through your handlers.

A machine-readable contract, generated from the code that serves it.

Every module documents its endpoints in an OpenAPI.php file, which zircote/swagger-php turns into a specification rendered through Swagger UI or Redoc. A Postman collection and environment ship alongside it, so every endpoint is ready to call by hand.

Your domain in entities, not in the query layer.

Doctrine ORM handles persistence, so you can focus on object-oriented business logic and treat storage as a secondary concern. Migrations, fixtures via dot-data-fixtures, and multiple database connections are part of the setup.

One predictable shape for resources, one for failures.

Payloads are built with mezzio-hal, describing each resource together with its relational links and embedded child resources. Errors return problem details responses via mezzio-problem-details, giving clients standardized error codes system-wide.

Client and server agree on format and language up front.

Content negotiation is implemented out of the box through the Content-Type and Accept headers, so diverse systems can consume the same API without custom glue on either side. CORS preflight requests are recognized and configured by mezzio-cors.

A channel for the bugs that never reach your logs.

Frontend developers can report incorrect behaviour by posting to /error-report with a token header. The API validates the request against configured tokens, domains and IPs before logging it - useful precisely when nothing fatal was thrown.

Scheduled work that refuses to trample itself.

Console commands are registered through dot-cli on top of Symfony Console, and php ./bin/cli.php route:list prints every endpoint the application exposes. The file locker, enabled by default, writes a lock file per command so a second instance cannot start while the previous run is still going - the safeguard cron jobs usually lack.

Account mail that works before you configure anything.

dot-mail wraps Symfony Mailer with templated messages, so account activation and password reset send out of a fresh install. It joins the request flow only where it is needed - the rest of the pipeline is unchanged whether a route sends mail or not.

New modules that already match the house style.

dot-maker generates project files and directories following the Dotkernel structure, and knows which files each application type needs. It replaces hand-copied boilerplate with consistent, standardized scaffolding.

Manage the same data your API serves.

Table-based record management with RBAC guards, CSRF-protected forms and 2FA, over the same Core module. Start with either one and add the other later.

Move slow work off the request cycle.

Background workers on Symfony Messenger - a TCP listener, Valkey streams, retries and a dead letter queue for what still fails.

When your users want pages, not payloads.

A web starter skeleton - user accounts, a contact form, sessions and RBAC-guarded controller actions, rendered on the server.

A presentation site with no API behind it.

The smallest complete Mezzio application - routing, pipeline and Twig, six direct dependencies and no database layer.

Teach your AI tools this architecture.

Drop-in Claude Code configuration - ten commands, seventeen skills and permission guardrails that keep your secrets out of the context window.