Configuration reference

Grocery Restable has two layers of configuration:

1. Bootstrap configuration — values needed before the SQLite store can be opened (paths, URLs, secrets). Set in app/Config/GroceryRestable.php / .env (CodeIgniter) or the array given to GroceryRestable::create().
2. Runtime settings — everything managed from the admin GUI, stored in the SQLite configuration database together with connections, resources, buckets, API keys and admin users.

Bootstrap options (core)

These are the keys accepted by GroceryRestable::create() (src/Config.php). The CodeIgniter config maps onto them (see CodeIgniter 4). Unknown keys throw an exception.

Key	Type / default	Description
framework	'standalone'	standalone (no framework) or codeigniter4. Set by the integration.
storagePath	required	Writable directory outside the web root.
configDatabase	{storagePath}/grocery-restable.sqlite	SQLite configuration store. Created with 0600 permissions.
uploadPath	{storagePath}/uploads	Base directory of field uploads.
bucketPath	{storagePath}/buckets	Base directory of storage buckets.
apiUrl	'/api'	Public URL (absolute or root relative) of the API. Used for links, Location headers, OpenAPI servers.
adminUrl	'/grocery-restable'	Public URL of the admin GUI.
adminEnabled	true	Disable the admin GUI.
debug	false	Include exception class, message and trace in 5xx API errors. Never in production.
encryptionKey	''	Key encrypting secrets in SQLite. base64:…, hex:… or any 32+ character string. Empty = a random key file {storagePath}/grocery-restable.key is generated.
setupToken	''	When set, the web setup wizard requires ?token=… (from any IP).
trustedSetupIps	['127.0.0.1', '::1']	IPs that may open the wizard without a token.
jwtSecret	''	Overrides the JWT secret stored in SQLite.
maxEmbedDepth	3	Maximum embedding depth.
maxBulkRows	1000	Maximum rows per bulk operation.
logger	null	callable(string $level, string $message, array $context) or a PSR-3 logger. Default: error_log(). CodeIgniter: log_message().

Generate an encryption key:

php -r "echo 'base64:' . base64_encode(random_bytes(32)), PHP_EOL;"

Back up the key (or the generated key file). Without it the stored database passwords and JWT secret cannot be decrypted.

Runtime settings (SQLite)

Edited on the Settings page or with $api->store()->saveSettings([...]).

Setting	Default	Description
app_name	Grocery Restable	Name shown in the GUI and OpenAPI info.title.
api_description	''	OpenAPI info.description.
default_connection	default	Connection used by auto expose and resources without setConnection().
auto_expose	false (wizard default: on)	Expose every table of the default connection that is not configured explicitly.
auto_exclude_tables	['migrations']	Tables never auto exposed.
auth_mode	api_key	none, api_key, jwt, any. See Authentication.
default_permissions	anon: [], authenticated: [select, insert, update, delete]	Permissions for resources and buckets without their own.
jwt_secret	'' (generated by the wizard for jwt modes)	HMAC secret, encrypted at rest, never returned to the GUI.
jwt_algorithm	HS256	HS256, HS384, HS512 (used when the GUI generates test tokens; verification accepts any of them).
jwt_role_claim	role	Claim holding the role. Dot notation for nested claims (app_metadata.role).
jwt_default_role	authenticated	Role when the claim is missing.
jwt_audience / jwt_issuer	''	When set, tokens must contain this aud / iss.
allow_query_apikey	false	Accept ?apikey= (handy for <img src>; keys end up in logs).
cors_enabled	true	Send CORS headers.
cors_origins	['*']	Allowed origins. * = any.
cors_max_age	600	Preflight cache in seconds.
default_per_page	25	Page size when the client sends no limit.
max_limit	1000	Upper bound for limit / per_page.
response_envelope	false	Wrap lists in {"data": [...], "meta": {...}} instead of bare arrays.
schema_cache_ttl	300	Upper bound of the schema cache in seconds (0 disables). Structure changes are detected earlier by a fingerprint query, see Database connections.
upload_allowed_types	gif|jpeg|jpg|png|webp|…	Default extension allow-list for uploads.
upload_max_size	20MB	Default maximum upload size.
delete_replaced_files	true	Delete files when replaced, cleared or when their record is deleted.
expose_openapi	true	Publish /api/openapi.json (always available to service_role).
setup_completed, framework	—	Written by the setup wizard.

The SQLite store

Table	Content
settings	Runtime settings (JSON values, secrets encrypted)
connections	GUI connections (password encrypted with libsodium secretbox)
resources	GUI resource definitions (JSON) and their enabled flag
buckets	Bucket definitions
api_keys	Key name, prefix, SHA-256 hash, role, timestamps, revocation
admin_users	Usernames and password_hash() hashes
login_attempts	Failed logins for throttling (pruned after 24 h)
cache	Schema cache

Export / import

Export / Import in the GUI downloads settings, connections (without passwords), resources and buckets as JSON and imports them elsewhere (e.g. from staging to production). Users, API keys and secrets are never exported.

Programmatically:

$json = json_encode($api->store()->export(), JSON_PRETTY_PRINT);

Prefer committing important resources as code — they are versioned with your application and always win over GUI definitions.