- OAuth2 authorization code flow Sign app users in with OAuth2 against Exponential - registering the client in oAuth admin, the authorize page and its exact redirect address, the oauth/authorize policy, exchanging the code at /api/auth/v1/oauth/token…
- A back end for your app Why most mobile apps on Exponential should talk to a small back end of their own (a backend for frontend) rather than to Exponential directly - the client secret, read-only credentials, caching, shaping answers and…
- Personal API keys for tools Use personal API keys (expk_) for development builds, tests, kiosks, back ends and internal tools around an app - getting one, scopes, lifetimes, the rate limit, rotation and revocation, the audit events - and why a key…
- expservices tokens in apps Authenticate an app against the expservices remote services - session sign-in with expsession::login, making a personal token (expt_) with expsession::tokenCreate, sending it as Bearer and X-Exp-Token, writes without a…
- Storing secrets on devices Keep Exponential credentials safe on phones and in browsers - what may be stored on a device at all, the platform secure stores (Keychain, Keystore), what never to store, logging and crash reports, backups, sign-out and…
- The Authorization header and proxies Why a valid credential can still answer 401 - how the REST layer and expservices read the Authorization header, servers and proxies that drop it (Apache with PHP-FPM), the server settings that pass it, the X-Exp-Token…
- JSON endpoints for apps The landing page of the JSON endpoint pages for app developers - the ezjscore call interface, the expservices remote services an app is most likely to use, and when to ask for a server function of your own.
- Calling expservices from an app Call the expservices remote services from app code - the URL with arguments joined by ::, percent encoding, the ezjscore wrapper and the envelope inside it, paging with meta.has_more, discovering services from the…
- Searching content Add search to an app through the expservices search domain, since the REST API has no search route - expsearch::search with text, limit, offset and a JSON filter (class, section, subtree, date), searching below a node…
- Writing through expservices Create, update and remove content from an app with the expservices node services - POST with a token and no form token, expnode::create with class, attributes as JSON and language, expnode::update which publishes a new…
- ezjscore server functions for your app When an app needs an endpoint no REST route or service offers - what to ask a PHP developer for, how an ezjscore server function is registered and called, its answer wrapper, the permission rules it must follow…
- Content modeling for apps The landing page of the content modeling pages for app developers - why the content classes, ids, languages and rich text of an Exponential site shape every screen of an app, and what to agree with the site team before…
- Content classes for apps Map Exponential content classes to app screens - finding the classes and fields a folder holds, reading class definitions with expclass services, classIdentifier as the switch for cells and views, handling unknown…
- Node ids, remote ids and deep links Identify content in an app so it survives reinstalls and moves - node ids versus object ids versus remote ids, configuring entry points by remote id, looking items up with expnode::getByRemoteId and expnode::getByPath…
- Multilingual content Serve an app in several languages from Exponential content - locales such as eng-US and ger-DE, the Translation parameter of REST reads, languageLocale on create, the site's languages from explanguage services…
- Rich text in apps Show article bodies (ezxmltext rich text) in an app - why the REST value is plain text, the three options (plain text, rendered XHTML in a web view, a structured export from a server endpoint), links and embedded images…
- Media and images for apps The landing page of the media pages for app developers - what the REST API gives for images (the original file path), how image aliases give screen-sized versions through expimage services, and what is not possible…
- Images in REST answers What an ezimage field looks like in a REST answer (the path of the original file, without alternative text), how to turn it into a URL, why the original is the wrong size for a phone, how to get the alternative text and…
- Image aliases for screen sizes Get images in the right size for phones and tablets - the shipped image aliases (reference, small, tiny, medium, large, rss), listing them with expimage::aliases, asking for one alias URL with expimage::url, adding…
- Files and uploads Download files from Exponential in an app (expfile services, the content/download URL, time-limited signed links for clients without a session) and why uploading photos or files from a device needs a custom endpoint…
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x