API Documentation

LaunchKit Pro exposes Swagger UI and OpenAPI JSON for developer and buyer exploration.

Paths

Resource	Default URL (local)
Swagger UI	http://localhost:4000/api-docs
OpenAPI JSON	http://localhost:4000/api-docs-json

Production (when enabled):

• https://api.yourdomain.com/api-docs
• https://api.yourdomain.com/api-docs-json

Paths are configurable via API_DOCS_PATH and API_DOCS_JSON_PATH.

Environment variables

Variable	Example	Description
API_DOCS_ENABLED	true	Master switch — register or hide Swagger routes
API_DOCS_PATH	api-docs	Swagger UI path segment
API_DOCS_JSON_PATH	api-docs-json	OpenAPI JSON path segment
API_DOCS_AUTH_ENABLED	false	When supported at the edge, require HTTP basic auth before Swagger
API_DOCS_USERNAME	replace_me_docs_user	Basic auth username (placeholder only)
API_DOCS_PASSWORD	replace_me_docs_password	Basic auth password (placeholder only)

Never commit real credentials. Store production values in your secrets manager or Nginx htpasswd file.

Modes

Mode	Configuration	Who can browse
Disabled	API_DOCS_ENABLED=false	No /api-docs routes (404)
Public	API_DOCS_ENABLED=true	Anyone can open Swagger UI; executing protected endpoints still requires a valid JWT
Protected	API_DOCS_ENABLED=true + basic auth at reverse proxy (recommended) or API_DOCS_AUTH_ENABLED=true when implemented	Only users with docs credentials reach Swagger

Recommendations

Environment	Recommendation
Local / staging	API_DOCS_ENABLED=true (public is fine on localhost)
Production / public demo	Protected (Nginx auth_basic) or disabled
Marketplace demo VPS	Protected or disabled unless you want a public explorer

Example Nginx protection (placeholders):

location /api-docs {
  auth_basic "LaunchKit API Docs";
  auth_basic_user_file /etc/nginx/.htpasswd-api-docs;
  proxy_pass http://127.0.0.1:4000;
}

Set API_DOCS_ENABLED=false to disable Swagger registration entirely at startup. The REST API continues to work.

::: note v1.0 behavior The primary built-in switch is API_DOCS_ENABLED. Protected deployments typically use reverse-proxy basic auth with credentials matching your documented API_DOCS_USERNAME / API_DOCS_PASSWORD placeholders. Interactive Swagger still uses Bearer JWT to execute protected API routes. :::

Bearer token usage

1. POST /auth/login → copy accessToken
2. Open Swagger UI → Authorize
3. Enter: Bearer <accessToken> (or paste token only, depending on UI)
4. Execute protected endpoints

curl -s http://localhost:4000/workspaces \
  -H "Authorization: Bearer <accessToken>" | jq

Use placeholder tokens in documentation only.

Export OpenAPI JSON

curl -s http://localhost:4000/api-docs-json -o launchkit-pro-openapi.json

Postman: Import → File → launchkit-pro-openapi.json

Insomnia: Create → Import From → File

Set collection auth to Bearer token at collection or request level.

Endpoint groups (tags)

Health, Auth, Profile, Workspaces, Workspace Members, Permissions, Billing, AI, Storage, Notifications, Email, Audit Logs, Admin, Feature Limits, Developer API Keys, Developer Webhooks, Support, Contact, Demo

Security

• OpenAPI schema must not embed real secrets, passwords, or private env values
• Do not paste production JWTs into shared Swagger sessions
• Disable or protect public docs in production when your security policy requires it
• Interactive "Try it out" uses credentials you supply — no hardcoded credentials in the kit

Related

• Developer Tools
• Environment Variables
• Troubleshooting — docs not loading