Recent changes
Wednesday November 04 2026
-
Upgrade step or migration? Updated Markdown page
When a change belongs in an upgrade step that exp:upgrade applies to every installation of the kernel or an extension, and when in a migration of one site; how the upgrade steps appear among the migrations, and how a…
-
Writing a reversible down() Updated Markdown page
How to write a down() that really undoes up() on every installation - idempotent, found by remote id or identifier, safe on every engine - when to leave it out, and how to prove it with up, down and up again.
-
Migrations: recording changes Updated Markdown page
Setup > Migrations > Recording step by step with screenshots. Record your own changes, or every change of the site in a site-wide window that closes by itself after a number of minutes; the Recording bar; what a…
-
Migrations: remotes and deploys Updated Markdown page
Setup > Migrations > Remotes and Deploys in the administration. Add the other installations this one deploys its migrations to with the wizard, test their connection, deploy to a selection or a group all at once and in…
-
Migrations: run, dry run and rollback Updated Markdown page
Running the pending migrations from Setup > Migrations, the dry run and the simulated run, resuming a failed run, and taking a run, one migration or an earlier caption back. Each runs in the background as you and asks…
-
Migration settings Updated Markdown page
Every setting that shapes migrations in one place - the five blocks of migration.ini with their defaults and a link to each generated reference page, the settings in site.ini, dashboard.ini, audit.ini and cronjob.ini…
-
Migrations: the status and the history Updated Markdown page
Setup > Migrations in the administration. The status page with every migration and its state, the history of the runs with their captions, commits and pushes, the page of one run that follows it live, and the dashboard…
-
Migrations: the migration editor Updated Markdown page
Setup > Migrations > Editor step by step with screenshots. Create a YAML migration without a shell - name it, choose where it goes, add steps with the form of each step type, reorder and remove them, check it, preview…
-
When a migration fails: troubleshooting by symptom Updated Markdown page
Troubleshooting migrations by what you see - a failed run, a refused run, a migration that does not run or runs where it should not, a held lock, nothing restored, a push that waits, a run in the administration that…
-
Authentication for apps Updated Markdown page
The landing page of the authentication pages for app developers - the three credentials Exponential accepts from programs (OAuth2 tokens, personal API keys, expservices tokens), the default that every REST call needs a…
-
A back end for your app Updated Markdown page
Why most mobile apps on Exponential should talk to a small back end of their own (a backend for frontend) rather than to Exponential directly - the client secret, read-only credentials, caching, shaping answers and…
-
The Authorization header and proxies Updated Markdown page
Why a valid credential can still answer 401 - how the REST layer and expservices read the Authorization header, servers and proxies that drop it (Apache with PHP-FPM), the server settings that pass it, the X-Exp-Token…
-
Choosing a credential Updated Markdown page
Pick the right credential for each kind of app on Exponential - a public reader app, an app whose users sign in, an internal staff app, a kiosk, a development build - with the reasons, the accounts to create and what…
-
expservices tokens in apps Updated Markdown page
Authenticate an app against the expservices remote services - session sign-in with expsession::login, making a personal token (expt_) with expsession::tokenCreate, sending it as Bearer and X-Exp-Token, writes without a…
-
OAuth2 authorization code flow Updated Markdown page
Sign app users in with OAuth2 against Exponential - registering the client in oAuth admin, the authorize page and its exact redirect address, the oauth/authorize policy, exchanging the code at /api/auth/v1/oauth/token…
-
Personal API keys for tools Updated Markdown page
Use personal API keys (expk_) for development builds, tests, kiosks, back ends and internal tools around an app - getting one, scopes, lifetimes, the rate limit, rotation and revocation, the audit events - and why a key…
-
Storing secrets on devices Updated Markdown page
Keep Exponential credentials safe on phones and in browsers - what may be stored on a device at all, the platform secure stores (Keychain, Keystore), what never to store, logging and crash reports, backups, sign-out and…
-
Checklists for app developers Updated Markdown page
The landing page of the checklists for apps on Exponential - security, launch and app store review readiness - with when to use each and who signs it off.
-
App store review readiness Updated Markdown page
General advice for preparing an app on Exponential content for app store review - a reviewer account, content that is present and stable, sign-in and account deletion questions, privacy statements about what the app…
-
Launch checklist for apps Updated Markdown page
A checklist for the week before an app on Exponential goes live - the production installation and its APIs, accounts and credentials, content and entry points, images, caching and load, error handling, monitoring…