Configuration and security
The API service reads settings from apps/api/.env or deployment environment variables.
| Setting | Purpose |
|---|---|
SUPER_API_MANAGER_DATABASE_PROVIDER |
SQLITE, POSTGRESQL, MYSQL, or MARIADB |
SUPER_API_MANAGER_DATABASE_URL |
Provider-specific connection URL |
API_PORT |
API port, default 4070 |
ALLOW_PRIVATE_NETWORK |
Whether private-network target addresses are allowed |
SUPER_API_MANAGER_SECRET_KEY |
Encryption key for secret environment variables |
MAX_REQUEST_BODY_BYTES |
Maximum request body size |
MAX_RESPONSE_BODY_BYTES |
Maximum response body size |
Persistence
Section titled “Persistence”SQLite is suitable for local evaluation. Shared or highly available deployments can use PostgreSQL, MySQL, or MariaDB. Prefer the SUPER_API_MANAGER_DATABASE_PROVIDER and SUPER_API_MANAGER_DATABASE_URL variables.
Private-network access
Section titled “Private-network access”ALLOW_PRIVATE_NETWORK=true is convenient for local intranet debugging but increases server-side request forgery exposure on shared or public instances. Set it to false unless required and enforce target restrictions at the network layer.
Key management
Section titled “Key management”- Never use documentation placeholder values.
- Inject secrets through the deployment platform’s secret manager.
- Every instance must share the same stable key.
- Losing or replacing the key affects access to previously stored secrets.
Request boundaries
Section titled “Request boundaries”Choose request and response limits based on real API sizes. Large values increase memory exposure; small values can block uploads or large responses. Shared instances should also enforce proxy-level body and timeout limits.