Installation & Setup

To use the V8 API, your server must support OAuth2 encryption and URL rewriting.

1. Generating Encryption Keys

The API uses a public/private key pair to sign Access Tokens. These must be stored in Api/V8/OAuth2/.

# Generate private key
openssl genrsa -out Api/V8/OAuth2/private.key 2048

# Generate public key
openssl rsa -in Api/V8/OAuth2/private.key -pubout -out Api/V8/OAuth2/public.key

Ensure the keys are owned by the web server user (e.g., www-data) and have 600 permissions.

2. URL Rewriting

All API requests must be routed to Api/index.php.

Apache: Ensure mod_rewrite is enabled. The required rewrite rules already ship in the site’s root .htaccess file — there is no separate .htaccess in the Api/ directory. Do not remove or bypass the root file.

The root .htaccess also includes a rule that passes the Authorization header through to PHP (env=HTTP_AUTHORIZATION). Some server configurations strip this header before PHP sees it — if OAuth2 authentication fails with a valid token, confirm this rule is present and that your server isn’t stripping the header upstream.