How does the PHPAPI interface control permissions?

Hello, control permissions are mainly related to whether to log in or not and the user's own permissions, but you need to use other information instead, because the API interface can't use session. My suggestion is that when the app mobile terminal sends a login request, you can generate token information after login. Token information needs to be encrypted according to the user number, and then stored by the mobile terminal, and sent together with the token at every other request, then you can judge whether there is a token, then decrypt the token to get the user number, and then judge whether there is corresponding authority through the user number.