Can I securely fetch templates without auth? about kirby-headless-starter

[johannschopplich]

Hi there,

yes, you can use this kit without authentication, of course. Taken from the usage section:

⚠️ Without a token your page content will be publicly accessible by everyone.

Thus, just leave the environment variable KIRBY_HEADLESS_API_TOKEN empty or delete it from your .env file. I've also update the README to make clear on how to use this headless kit tokenless.

With the template approach – which is pretty similar to content representations – you only expose data that you choose.

You can then fetch your data without having to provide an authentication header, like:

import { $fetch } from "ohmyfetch";

const response = await $fetch("<website-url>/about.json");

console.log(response);

Have fun!