Protect a developer-only route

Steps

Use application-owned middleware to authenticate and authorize before controller resolution.

// Registration fragment; $access is the composed DeveloperAccess middleware.
$router->get('/api/search', DocumentationController::class . '::search')
    ->middleware($access)
    ->name('knowledge.search');

Read the principal from RequestAttribute::PRINCIPAL, not a guessed attribute name. Then filter document permissions again before reading bodies, search, or provider context. A hidden button is not a permission check.

Verify

Anonymous API reads return 401 without document bodies. A revoked account loses access on its next protected request. See Authentication and security.

Editorial provenance

Source: resources/guides/protect-route.md. Source SHA-256: 87e22e899bba1dfbc55eb57e8438106baa7fba7a857671532115bd097648a84f.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.