Panel Configuration

Where the Panel's preview button sends an editor, and what a browser gets when it opens the backend URL directly.

Frontend Preview URLs

In headless setups, Panel preview links point to the backend by default. Use the frontendUrl page method to redirect preview links to your frontend application.

Blueprint Configuration

Set the preview option in your blueprint to use the frontendUrl method:

site/blueprints/pages/default.yml

options:
  preview: "{{ page.frontendUrl }}"

For the site blueprint, use site.frontendUrl:

site/blueprints/site.yml

options:
  preview: "{{ site.frontendUrl }}"

Config Setup

Configure your frontend URL in config.php:

config.php

return [
    'headless' => [
        'panel' => [
            'frontendUrl' => 'https://example.com'
        ]
    ]
];

Without frontendUrl, the frontendUrl page and site methods return null. A blueprint that builds its preview URL from them ends up with an empty one – Kirby still renders the preview button, it just leads nowhere.

Panel Redirect

For headless-only projects, automatically redirect visitors to the Panel when they access your backend URL. This is useful when your Kirby installation serves no frontend content.

config.php

return [
    'headless' => [
        'globalRoutes' => true,
        'panel' => [
            'redirect' => true
        ]
    ]
];

The redirect lives in the global catch-all route, so it takes effect only with headless.globalRoutes enabled – or in your own route built with Middlewares::hasBearerToken(true). A request that arrives there without an Authorization header is sent to the Panel, but only if it carries an Accept header asking for something other than JSON, which is what a browser navigation does. A client that asks for JSON is answered with JSON, and so is a client that sends no Accept header at all.

CORS

Set up cross-origin access for public APIs or authenticated frontends with support for multiple origins and dynamic closures.

KQL (Kirby Query Language)

Extends the official KQL plugin – swaps basic auth for bearer tokens, caches queries, and runs them in the language the request names.