Authentication

Bearer Token Authentication

By default, the Kirby Headless /api/kql endpoint uses bearer token authentication. This provides a modern alternative to basic authentication for KQL requests.

Set a secret token in your config.php:

return [
    'headless' => [
        'token' => 'your-secret-token'
    ]
];

Include the token in your requests using the Authorization header:

const response = await fetch("https://example.com/api/kql", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.KIRBY_API_TOKEN}`,
  },
});

Basic Authentication

To use basic authentication instead, configure the kql.auth option. This disables bearer token authentication while keeping caching and multi-language support:

return [
    // Enable basic authentication for the Kirby API
    'api' => [
        'basicAuth' => true
    ],
    // Use basic authentication for KQL
    'kql' => [
        'auth' => true
    ]
];