Summary

We started this chapter by explaining the difference between Strapi admin users and API users. Afterward, we explored how API users can sign up and log in to the API using the routes exposed by the users-permissions plugins. We also discussed JWTs and saw how we can edit their configurations.

After that, we started working on securing and protecting the API routes. We changed the create tutorial's endpoint, making it accessible by logged-in users only, and explained how the authorization flow works in Strapi.

Then, we took a deep dive into the roles and permissions. We revisited the main actors diagram for our API and used it to create the required roles by our API.

Finally, we introduced the concept of policies in Strapi and saw how can we use them to further enhance the API authorization flow by allowing users to edit and delete their own content only.

In the next chapter, we will explore the Strapi plugin system. We will understand the Strapi plugin ecosystem...