The admin panel is a dashboard served by your own API at /admp. It reads the data your API already stores, so there is nothing to deploy alongside it.
1apiker.init({2 routes,3 exports,4 authRoutes: true,5 adminPanel: true,6 objects: ["Common", "Users", "Logs", "Bans", "Beacons"]7});What it shows
- Overview — how the deployment is configured, plus live counts of events, bans and rate limits.
- Users — search the directory, edit a record, grant admin, or delete an account.
- Bans — ban or lift a ban, and read the history behind one.
- Logs — search recorded activity by prefix or user.
- Beacons — the analytics report, with per-day and per-country breakdowns.
- Email — re-send a verification or password reset to a user.
Claiming the first admin
There is no admin until you create one. Open /admp and sign in with your email, a password and the value of ADMP_SETUP_SECRET — that account becomes the first admin. After that, sign in with email and password alone.
Restricting access
Access is gated by network before any credential is checked. Set at least one of these, or the panel refuses everyone:
- ADMP_IP_WHITELIST — a comma separated list of addresses.
- ADMP_ISP_WHITELIST — network operators, matched by geolocation lookup.
- ADMP_CITY_WHITELIST — cities, matched the same way.
A whitelist of * allows everyone and is only honoured under wrangler dev, never in production. Deploying without a whitelist closes the panel rather than opening it.
Sessions
Signing in sets an httpOnly, secure cookie that lasts an hour, and every privileged request must also echo the token in an X-Apiker-Csrf header — so a cookie alone, sent by another site, is not enough to act on your API.
