The panel is served from your own API, so it is exposed to the internet like any other route. A network whitelist is required before anything else runs — it is not an optional hardening step.
1. Configure a whitelist (required)
Requests are filtered before any password is checked, and apiker refuses every request to /admp until at least one of these is set:
ADMP_IP_WHITELIST = "203.0.113.10,198.51.100.4"
ADMP_ISP_WHITELIST = "Your ISP"
ADMP_CITY_WHITELIST = "Toronto"Leaving all three empty does not open the panel — it closes it, which is the safe default if you forget.
2. Claim the first admin, then rotate the secret
The first person to sign in with the right ADMP_SETUP_SECRET becomes an admin. Once you have claimed your account, change that secret so the path cannot be used again.
Sessions
A session is an httpOnly, secure cookie valid for one hour, and privileged requests must also send the token in an X-Apiker-Csrf header — so another site cannot act on your API using the cookie alone.
