Authentication

Bearer Token Authentication

The Kirby Headless plugin exposes your content to the public by default. To secure your API, you can enable bearer token authentication for the KQL and custom API endpoints. This is especially useful for KQL requests, as Kirby's default KQL endpoint only supports basic authentication.

To enable bearer token authentication, set the headless.token global option in your config.php to a secret string:

return [
    'headless' => [
        'token' => 'test'
    ]
];

You will then need to include the HTTP header Authorization: Bearer {token} with every request.

Basic Authentication for KQL

If you prefer the default basic authentication method, you can still enable it by setting the kql.auth option to true. This will disable bearer token authentication, but still provide features like caching and multi-language support:

return [
    // Enable basic authentication for the Kirby API (required for KQL)
    'api' => [
        'basicAuth' => true
    ],

    // Default to basic authentication
    'kql' => [
        'auth' => true
    ]
];