Module Configuration

AppApi has several configuration parameters in the module settings that you can use to customize the module to your requirements.

• API Endpoint: Lets you choose under which url your api should be available (default „api“)
• Path to Routes.php: Location of the Routes.php file, where AppApi will find the $routes definition array. Base of path: ProcessWire-Root (Location of index.php) (default „site/api/Routes.php“)
• Activate Access-Logging: Activate when you want to have access logging for your api. Will write access-data in "appapi-access.txt" log. (default: false)
• Deactivate URL Hook: Will deactivate route-handling by ProcessWire URL hook and fallback to ProcessPageView::pageNotFound hook.
• Use URLs relative to ProcessWire root: If activated, all URLs returned by the api endpoints will be relative to the ProcessWire root URL. Can be useful if ProcessWire is installed in a sub-directory. [new in v1.4.0]
• Disable the automatic setting of Access-Control-Allow-Origin headers: If activated, AppApi will not add any access-control-headers by itself. You need to take care of that on your own to prevent CORS issues.

Allowed origins (CORS)

Since version 1.5.0. A list of origins that may access the API from a browser, one per line. Each entry consists of scheme, host and optional port, e.g. https://www.example.com or http://localhost:3000.

• Scheme and port must match exactly (https://www.example.com does not match https://www.example.com:8443), the host is compared case-insensitively.
• A * in the host matches one or more characters except a dot, so it never spans more than one part of the host name: https://preview-*.example.com matches https://preview-123.example.com, but neither https://preview-.example.com nor https://preview-1.evil.com.example.com.
• If the list is empty, AppApi behaves as before and mirrors the Origin of every request in Access-Control-Allow-Origin.
• If the list is set, the Access-Control-* headers of regular and preflight (OPTIONS) requests are only sent for matching origins, and every response gets a Vary: Origin header.
• If "Disable the automatic setting of Access-Control-Allow-Origin headers" is activated, this list has no effect.

Disable the "authorization" query parameter

Since version 1.5.0. By default, AppApi also accepts an access token as URL parameter (?authorization=...) if no Authorization header is sent. Activate this setting to accept tokens only in the Authorization header. Tokens in URLs can end up in server logs, the browser history and referrer headers. The api_key URL parameter is not affected.

---

➡️ Continue with 2.0: Defining Applications

⬅️ Back to Changelog