- admin4 components and tokens A reference card of the administration's shared components (.a4-* classes) and design tokens (--a4-* custom properties) an extension's admin pages use, with the rules that keep them working in light and dark mode.
- Common template mistakes The template mistakes that cause most bugs, security holes and slow pages, each with its symptom and fix: unwashed output, fetch in loops, missing limits, cache keys, user data in cached views, quotes around ezurl…
- CSRF protection and ezformtoken How cross-site request forgery is prevented in Exponential and what PHP code must do - the ezformtoken listeners on request/input and response/output, which requests are checked, the form field and the X-CSRF-Token…
- Debugging extensions A routine for an extension that does nothing or breaks a page: is it active, are its settings read, do its classes load, are caches or workers stale, with the RAD health check, checkclasses and the logs.
- Debug output in production For administrators of public sites - why debug output must stay off in production, Exponential's debug settings and their safe defaults, how to debug a live problem for your own address only and remove it again, and…
- Headless and decoupled front ends Using Exponential as the content back end of a front end written in another framework - Next.js, Nuxt, a Laravel or Django site, a mobile app - what stays in Exponential, which API to read, rich text and images…
- OAuth and API keys Choose and use the right credential for programs that call Exponential - OAuth2 clients and the authorize policy, personal API keys with scopes, expservices tokens, HTTP basic, lifetimes, revocation and the audit trail.
- Preference, module, package and PDF operators The kernel operators ezpreference, ezmodule, module_params and ezpackage and the library operator pdf - what each reads, its parameters, what it returns, which of them have side effects - with examples rendered on a…
- Pull requests to someone else's theme Prepare a pull request that a maintainer can merge quickly - small and focused, explained, tested, with screenshots for visual changes and no unrelated or private content - and how to respond to review.
- Restrict debug output Step by step - make sure Exponential's debug output is off in production, and when a live problem needs it, switch it on for your own address only, then remove it again and check that nothing is shown to visitors.
- Service accounts, roles and policies Giving an integration exactly the rights it needs - a service account per integration, a user group and a role of its own, the policies typical integrations need (content read, create, edit, remove, apikey/create…
- Caching after imports Which caches an import or a sync touches and which it does not - what the publish operation clears on its own, when to clear more, the cache ids of ezcache.php, the HTTP cache and Velocity's response cache, caches after…
- CSRF and form tokens For administrators and developers of public sites - how the ezformtoken extension protects every form against cross-site request forgery, how to check it is active, what custom AJAX code must do, and the form expired…
- Keeping a fork in sync Bring the original theme's fixes into your fork regularly - an upstream remote, fetch and merge, resolving conflicts in templates, and keeping your own changes small so merges stay easy.
- Lock settings with ManagedByDeployment Step by step - switch on ManagedByDeployment for the production administration siteaccess so the web interface cannot change settings, templates, extensions or packages, after moving those settings into version control…
- Performance in extensions Keep an extension fast and safe under persistent workers: count queries, fetch with limits, cache, keep listeners cheap, measure, and never keep request state in statics.
- Performance measurement and benchmarks How to measure Exponential's performance before and after a change - exp:benchmark in its http, kernel, micro and baseline modes, the micro benchmark CI runs on every push, the debug bar's timing and SQL figures…
- Remote services with expservices Drive Exponential from scripts, apps and other front ends with expservices - over a thousand named services, discovery, the answer envelope, the shell and Python clients, tokens, policies per service, and adding a…
- Siteaccess operators The kernel operators that know the siteaccesses of an installation - siteaccess_url, siteaccess_menu, siteaccess_menu_key and language_switcher - with their parameters, the settings behind them, what they return, how…
- Testing: PHPUnit, database tests and checks How to test an application on Exponential for developers used to WebTestCase, Laravel's HTTP tests, Django's test client or Rails system tests - PHPUnit without a database for services, tests against a throwaway…
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x