Remote access & security

The API runs on the relay port (default 9900). To let external servers/workers call it, set up an Internet address in Settings → Internet & Cloud (Cài đặt → Internet & Đám mây), under the "Employees and API" service (Nhân viên và API), and choose one way to create the address:

1. Automatic Cloudflare (recommended) (Cloudflare tự động): connect your Cloudflare account at the top of the page → choose a domain + "Machine name" (Tên máy) → Apply (Áp dụng). Deplao creates the tunnel and a fixed address on your domain by itself; the address is shown in the services table, and you call the API at https://<address>/api/v1.
2. ngrok: dashboard.ngrok.com → Your Authtoken → paste it into the Authtoken field; under Domains → claim the free static domain → paste it into the Static domain field (Domain tĩnh); turn on "Employees and API". Fixed URL: https://<domain>/api/v1.
3. Manual Cloudflare (Cloudflare thủ công; you have configured the tunnel yourself): one.dash.cloudflare.com → Networks → Tunnels → create a tunnel (Cloudflared), copy the token and paste it into the Tunnel token field; add a Public Hostname pointing to http://localhost:9900; enter the public address, then turn on "Employees and API". The token is stored encrypted.
4. Temporary address (Địa chỉ tạm): no account needed, but the URL changes on every restart, for testing only.

#Recommendations when exposing the API to the Internet

• Create a separate key for each system, with the minimum scopes and restricted accounts.
• Set allowed IPs if the calling server has a fixed IP (the real IP is taken from the tunnel headers).
• Webhook receivers on your side must use https and verify signatures.
• By default anyone can view /docs and /api/v1/openapi.json (they only describe the endpoints, no data). To require a key when they are viewed remotely, turn off "Public docs" (Tài liệu công khai) in the Advanced tab (Nâng cao).
• Enable IP restrictions / basic auth in the ngrok dashboard, or Cloudflare Access, for production environments.
• Note: the employee-mode file endpoints (/api/media/*, /api/library/file|thumb/*) require an employee login session (the employee app's token; they only return files of the assigned accounts) and do not accept API keys. External systems download files through API v1 (e.g. GET /api/v1/library/items/{uuid}/file) with a key that has the right scope.

#Emergency switches

• Tools → Apps, API & Webhook → API (Công cụ → Ứng dụng, API & Webhook → API) → turn off API (returns 503 immediately, no logs/events are written).
• Revoke all keys (Thu hồi tất cả key) in one click.