Project Structure

A project created with npx apiker looks like this:

my-api/
├── src/
│   ├── index.ts        your routes and apiker.init()
│   └── objects.json    the Durable Objects to export
├── app.toml            committed configuration
├── wrangler.toml       generated at build time — do not commit
├── .env                generated secrets — do not commit
└── package.json

app.toml

This is the file you edit and commit. It holds the Worker name, routes, Durable Object bindings and migrations — everything that is configuration rather than a secret.

name = "my-api"
account_id = "YOUR_CLOUDFLARE_ACCOUNT_ID"
workers_dev = true
main = "./dist/shim.mjs"
compatibility_date = "2024-09-23"
compatibility_flags = [ "nodejs_compat" ]
#route = "your.domain.com/*"

[build]
command = "npm install && npm run build"

wrangler.toml

Generated on every build by merging app.toml with the values in .env. Because the merged result contains live secrets it is gitignored, and you should never edit it by hand — your changes are overwritten on the next build.

.env

Holds the secrets the build injects into the Worker environment. Two are created for you on the first build if they are missing:

APIKER_SECRET_KEY — signs JWTs and every internal hash. Rotating it invalidates all issued tokens.
ADMP_SETUP_SECRET — lets you claim the first admin account in the admin panel.

Keep wrangler.toml and .env out of version control. Both contain live secrets, and wrangler.toml is regenerated on every build anyway.

src/objects.json

An array of Durable Object names. The build reads it to register any object that is missing from app.toml and to write the migration that creates it, so adding a new object is a one-line change.

["Common", "Users", "EmailToUUID", "RateLimit", "Bans", "Logs", "Beacons"]

Common — general-purpose state used by apiker's built-in features.
Users — user accounts for apiker's built-in email/password and OAuth authentication.
EmailToUUID — a lookup index mapping an email address to its user id.
RateLimit — per-caller request counters backing the rate limiter.
Bans — the firewall's list of banned entities.
Logs — request and event log entries shown by the admin panel.
Beacons — counters for custom named analytics events.