Skip to content
This page View Markdown Open in ChatGPT Open in Claude

Before you go live

A new installation is set up for its first steps, not for real users. Go through this list before real data arrives, and again after a big change.

Accounts and passwords

  • Change the passwords of the admin panel. The install script creates [email protected] (R00t_123456789) and [email protected] (Admin_123456789) : change the first in Root Settings, the second in its profile.
  • Turn on two-factor sign-in for the people of the admin panel.
  • Replace the API user default. Its password is 12345, in the secret (common.apiUserPasswords.default). Give each application an API user of its own with a long password, and delete default or change its password.

Who reaches what

  • Replace the group Default. It grants everything. Make small groups, one per screen or per job, with the tables, APIs and fields each needs, and no allCollections or allSystemApis.
  • Close the row gate. Every table people reach through the generated APIs needs a row scoping pre hook : the owner in every filter, stamped on every write.
  • Run the security report and fix or skip, with a reason, every finding. Aim for grade A.
  • Review what is public. The APIs marked IS_PUBLIC, and the system APIs opened over HTTP : each one has a reason.
  • List the allowed origins of your web apps, so browsers on other sites are refused.

The server

  • HTTPS only. Install with Caddy and SSL (--ssl=yes and your domains, see Install on a server), so tokens never travel in clear.
  • Set your licence key. The key of API Maker Launchpad is for development on a computer.
  • Keep the databases private. Your databases, and the MongoDB and Redis of API Maker, answer on a private network or on the server itself, never on the internet.
  • Back up. The MongoDB of API Maker (mongodump), your own databases, and /root/config/.env with license.txt : a backup you have restored once is the one you can trust.

Your code

  • Run only code you trust on the server. The sandboxes stop faulty code, not hostile code : read what they protect. For clients who must not see each other's data, use separate servers.
  • Keep secrets in the secret. No key or password written in the code : the code scan of the report finds them.
  • Run the test cases : npm run test in the folder of the local client.